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“PAGE THO ALEXANDRIA’ (196B-NEW) -UNCLAS : 
FOR THE INFORWATION.OF THE SUREAU AND RECEIVING OFFICES, GEN. 
BRAL TELEPHONE AND ELECTRONICS CTE) Oils “AND OPERATES A’ COMPUTER 
NETWORK KNOWN AS TELENET WHICH LINKS VARIOUS SURSCRIBER COMPANIES 
AND GOVERNMENT AGENCIES THROUGH ‘A TEE-IN SYSTEM IN NUMEROUS CITIES. 
ACCESS. 1S OBTAINED ‘BY CALLING A PUBLISHED TELEPHONE MUMBER TN, VAR 
IOUS CITIES. TELENET HAS MOST RECENTLY BEEN 1 THE NATIONAL MEWS: 
NEDIA AS A RESULT OF UNAUTHORIZED ENTRIES GENERATING FROM THE MIL- 
WAUKEE AREA BY A GROUP NF EXPLORER, BOY soouTse. | 
WITHIN THE TELENET SYSTEM IS A SERVICE CALLED TELEMALL, WHICH 
“OFFERS A: COMPUTERIZED MESSAGE CAPABILITY BETWEEN TELEMAIL “‘cUSTOMERS 
AND WITPIH AWY TELEWAIL SUBSCRIRERS COMPANY.. EACH TELEMAIL suBS- 
CRIBER IS RESPONSIBLE FOR SETTING UP AN. "IW HOUSE”. ADMINISTRATOR 
TO OVERSEE ALL- ADMINISTRATIVE, FUNCTIONS OF THE CUSTONERS TELEMAIL 
SERVICE, INCLUDIGY THE ASSIGNMENT OF 1 LEVELS OF ‘ACCESSABILITY BY 
EMPLOYERS OF THE SUBSCRIBER COMPAIY. 
RECENTLY, IT HAS. COME TO’ THE ATTENTION OF GTE. THAT comPuTERS 
OF CERTAIN TELEMAIL SUBSCRIBERS HAVE SEEN ACCESSED BY, a GROUP OF 
INTRUDERS. FROM DIFFERENT AREAS OF THE COUNTRY. THE INTRUDERS 
“SOWE OF WHOM HAVE RANDED TOGETHER IN GROUPS KNOWN aS "INNER CIRELE" 


I 
AND " OPERATIONS CIRCLE “ HAVE G@ATHED -ACCESS, TO CERTAIN SUBSCRIBERS 


COMPUTERS BY DETERMINING PASSWORDS ASSIGNED TO SUBSCRIBER ADMINIS ~- 


TRATORS, AND ESTABLISHING PIRATE "BULLETIN BOARDS" WITHIN THE SUBS= 


CRIBER SYSTEM, AS WELL AS BROWSING THROUGH SUBSCRIBER FILES. ‘THESE 


Re ¢ | > 


PAGE THREE ALEXANDRIA C196B-NEW) UNCLAS 
“BULLETIN BOARDS” HAVE BEEW ESTABLISHED YITHOUT THE SUBSCRIBERS 
KNOWLEDGE OR CONSENT AND NAINTALN. THEIR OUiW. DEGREE OF SECURITY. 
ONCE IT WAS DETERMINED THAT CERTALW TELEMATL CUSTOMERS FILE 
WERE BEING INFILTRATED GTE WAS ABLE TO RETRIEVE MESSAGES POSTED.ON 
©. BULLETIN SOARDS AND DETERMINED THAT TRAFFIC BETWEEN “LHNER 
CIRCLE” MEMBERS DISCUSSED OW ‘AUGUST 15,1983, "AN OPERATION KNOWN AS. 
“ULTIMATE RIPOFE", I OWE OF THE WESSAGES ON THE BULLETIN BoaRD 
on 8/1573, UNsUBL_ NOTED’ To uxsus [raat HE Cc 
PICKED THE WRONG SYSTEW BECAUSE CODE 21256 1S .a DEMO SYSTEM AND: | 
"YOU CAN'T REALLY DO ANYTHING WITH it. [Da pvtsepl__ 
HE WAS SUPPOSED TO GET INTO SYSTEM C2267. FOR THE INFORMATION or Pe. 
RECEIVING OFFICES, OTH ACCOUNT NUMBER 21856 AND C21267 ARE TELENAIL 
- ACCOUNTS ASSIGNED TO CITIBAWK, NEW YORK, NY. 
"4 SECOND WeSSAGE POSTED.oW 8/15/83 From ANNOUNCED a 
CONFERENCE (PRESUMABLY A TELECONFERENCE) FOR LATER THAT EVENING 
HERE THE TOPICS UNDER DISCUSSION WULD INCLUDE “COSMOS”, ULTIMATE 
RIPOFF" AND "BLU - STUFF".<° FURTHER TRAFFIC ON THAT DATE ISSUES ‘C 
“CAUTION TO. MEMBERS OF THE CIRCLE TO: PURGE MESSAGES ONCE TREY ARE 
RETRIEVED OFF THE BULLETIN BOARD, AS WELL us “IssuTNG CAUTIONS TO 
HEMBERS NOT T9 USE TELEPHONES FOR COMMUNICATIONS RELATED To THE 
uLTmaATe RePPOFF, 
Spsereosaeae te” ANOTHER MESSAGE ON 8/15/83 ASKS THE QUESTION 


"WHO IS GOING INTO THE BANKS AND PICK UP THE MONEY"? 


PAGE FOUR ALEXANDRIA (I96B~NEW) UNCLAS 
ON LATE AFTERHOON, 8/25/83 GTE ADVISED. ALEXANDRIA THAT A FUR- 
THER REVIEW OF THEIR SYSTEM Has UNCOVERED OTHER INTRUDERS NOT PRE- 


VIOUSLY DISCERNALBE TO GTE WHICH INDICATES THIS INTRUSION PROBLEM 
IS FAR MORE WIDESPREAD THAN PREVIOULY THOUGHT. - ate IS COMPILING 


DATEY AT THE PRESENT TIME AND 4 MEETING IS SET FOR’ AM, 8/29/83 SET 
WEEN REPRESENTATIVES OF GTE AND FBI, “AX DIVISION TO DISCUSS THESE 
LATEST FINDINGS. 3 

IW THE MEANTIE, RECEIVING OFFICES SHOULD BE ALERT 10 THE 
FACT THAT US ATTORWEY ELSIE MUNSELL, EDVA HAS BEEN CONTACTED AND 
1S OF THE OPINION THAT THE PERPETRATORS COUD BE SUBJECT TO PROSE- 
CUTION FOR VIOLATION OF T 18,-USC, SECTION 1343, (WIRE FRAUD), 

AUD T 1%, USC SECTION 371, (CONSPIRACY) AT A MINIMUM. 

CALLS ARE ENTERING THE. SYSTEM THROUGH TELENET PORTS IN. DETROIT, 
MICHIGAN; SAN DIEGO, CALIFORNIA; WEW YORK, NY.3; WHITE PLAINS, HY 
AREA AND BALTIMORE , MARYLAND AREA. GTE IS MAKING A CONCERTED EFFORT 
TO WRITE A PROGRAM INTO THE SYSTEM THAT WILL ALLOW FOR A 24 HOUR A 
DAY. LIVE MONITOR ON ACCOUNTS KHOWN TO BE ACCESSED BY MEMBERS OF, THE 
CIRCLE GROUPS AND IT IS ALSO ANTICIPATED THIS WILL BE TN FULL 
OPERATION BY 8/29/83. ae , - 

PRIOR TO THE DISCOVERY OF THE LATEST INTRUSIONS, GTE HAD EST- 


IMATED LOSSES’ TO GTE AT. APPROXIMATELY $20,000 PER MONTH, BASED ON 
z ON eo RR 


WAKE THIS 4 CONSERVATIVE IGURE. 
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ALEXANDRIA IS ASSUMING. 00° IN THIS WaTTER LHASMUCH ASN orig 
COMPANY IS IN AX TERRITORY aNd DISCUSSION WITH-Usa HAS iwptcay. 
VENUE COUD LIE IN-EDVA. SINCE GTE, VIENNA, VA. OPERAT RATES cuttin \. 
TELEMAIL SYSTEM NATIONWIDE AND HAS CAPABILITY TO MONITOR THE enTERE. 
SYSTEM, AX IS LOGICAL CHOICE FOR COORDINATION OF INVES STIGATION. 

& MORE EXPLICIT AND. DETAILED COMMUNTCAT 10H WILE FOLLOW, TO. INCLUDE 
ALL DISEERNABLE INFORMATION THAT-WAY BE OF ASSISTANCE IN. IDENTIFYING 
UNSUBS, AS SOON AS THIS-1NFORMATION CaN BE COMPILED. ; , 

IN view oF NATIOWWIDE COMMUNICATIONS WORDERS OF AMERICA (Cua) 
STRIKE AGAINTS THE BELL PHONE SYSTEM, THIS COMMUNICATION IS BEING SUPP- 
LIED TO OFFICES HAVING AN INVESTIGATIVE°INTEREST SO THAT. PRELIMINARY 
CONTACTS CaN BE MADE WITH TELEPHONE COMPANY -PERSOWNEL IN AFFECTED 
JURISDICTIONS. ; 

AT THE PRESENT TIMZ, ALL RECEIVING OFFICES ARE REQUESTED TO MAKE 
CONTACT WITH APPROPRIATE TELEPHONE COMPANY (TELCO) SECURITY PERSONNEL 


IN THEIR RESPESTIVE AREAS IN AN EFFORT TO DETERMINE WHAT, IF ANY, TYPE 
OF AUTHORIZATION 15 NEEDED TO: PLACE TRAPS ON INCOMING TELENET ACCESS 
LINES IN THE AFFECTED AREAS. IN AN EFFORT To TRAP CALLS PLACED BY Ute 
SUBS. IN THE EVENT IT IS NECESSARY FOR GTE nonETORI Ne PERSONNEL TO MAKE 


IMMEDIATE CONTACT WITH TELCO PERSO NWEL IN AFFECTED AREAS WHEN UNSUBS 
COME ON LINE, RECEIVING OFFICES, SHOULD ADVISE ALEXANDRIA OF NAMES AND 
TELEPHONE NUMBERS OF TELCO SECURITY PERSONNEL WHO HAVE SEEN CONTACTED | 
IN THIS MATTER, AS WELL AS ANY SPECIAL THSTRUCTIONS: TH 1AT TELCO REQUIRES 
FOR PLACEMENT OF TRAPS ON THE GTE LINES. 


SUTEL RESULTS OF TELCO CONTACTS TO AX BY COB 8729/83. 


HY SHOULD SPECLFICALL NOTE THAT NO-LEAD.IS AT. THIS TIME Sey FORTH 
FOR CONTACT WITH CITIBANK, INASMUCH AS GIE “IS COMPILING DATPY TO MERT 
CLTIBANK OFFICTALS: AS’ TO THE DEGREE AND. SEVERITY OF ATTEMPTED. PEWETR- 


ATION. 
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ON AUGUST 29, 1983, 


AND POT Q1AC TELEPHONE COMPANY , CONSTELLATION PLACE, BALTIMORE» MARY= 
LAND, TELEPHONE NUMBER (361) 393-4152, ADVISED HE IS NOT PRESENTLY 
KN CSL EDGE ABLE OF THE PROCEDURE FOR PLACING TAPS. AFTER- CONSULTING 
WITH HIS LEGAL. AND DATA PROCESSING DEPARTMENT S” HE WILL PROVIDE THE 


BALTIMORE OFFICE WITH THE NFRRESSARY. DETAR fe If, 471s = 
, we + BE-LA 


LEAD®: BALTIMORE AT BALTIMORE? MAINTAIN Cmact WITH 


eatore east REE) 


AND REPORT RESULTS TO ALEXANDRIA, ASAP. b7C 


a me, ; "SEP = 1983 : 
a 


ihe ys - een 
tye 
v9 : 


a 


. ‘ v ’ » 
: : Exec AD Adm, 
oo Nibiaranaan™ @ ee , Calpe 


Exec AD LES 
Agee Diet 


al Mr. Revell . Date August 30, 1983. Lesct com. cA 
OFF, Cong. & 
Public Affs. 
Rec. Mgnt. 

mart ——i vo cb 


Subject : 


UNSU. 


TIONS CIRCLE; UN 
AND ELECTRONICS & : BAIL, _SYSTEM 
Mee OO: AX a8 


UTEOR, 


PURPOSE: 


To provide information concerning the unauthorized acgess, 2 
to Telemail, a service in they ‘eoneral Telephone and Electronics ‘Sy Srene 
Company (CTE) Telenet system W ich TiSkS Various subscriber compa cain 
nies and Government agencies, 


\ RECOMMENDATION: 
‘a & 
None, for ,information only. = 


APPROVED: Adm. Serve. ratory. 
Crim. ny, Legal Coun, 


Orrector z Off. of Cong. 


S Exec. AD-Adm, Kent, Hats a 
Y we Exec. AD-nv. inspection Tech. Serva. 
4 Exec. AD4ES intel, Trai 
DETAILS: ak 


GTE owns and operates a computer network known as Telenet 
which links various subscriber businesses, companies, and govern- = 3 
ment agencies in numerous cities. Within the Telenet system is a 
service known as Telemail. This service ay a computerized mes~ 
sage capability between Telemail custo YU 3- 

2 : 

Recently, GTE learned Ehat cormurers.. df Soe of|ftheir 
Telemail subscribers have been accessed by unauthorized intruders, 
some of whom have organized into groups using group names such as 
"Inner Circle" and “Operations Circle". The unauthorized access is 
accomplished by obtaining passwords assigned to subscribers; there- 
after, the subjects create a "bulletin board", an infgrmation source 


7 bee iS two 


FBI/DOS 
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ee Mr. Revell Memorandum 
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for other unauthorized accessors which has its own type of security 
system. GTE has been able to retrieve messages posted on the 
"bulletin boards” and has learned that the subjects have operations 
with code names of "Ultimate Rip-Off",. "Cosmos", and "Blu-Stuff". 
Some of these messages also contain access information; one message 
involved access to accounts assigned to Citibank, New York, New York. 
One message on 8/15/83, asked "Who is going into the banks and pick 
up the money?” 


At this time, GTE is uncovering evidence of numerous intru- 
sions from Detroit, Michigan; San Diego, California; New York, New 
York; and Baltimore, Maryland. GTE is writing a program into their 
system which should be operational by 8/29/83, which will allow 24 hour 
a day monitoring of all accounts known to be accessed by the subjects. 


The United States Attorney (USA), Eastern District of Vir- 
ginia (EDVA), has advised that the subjects could be violating the 
Fraud By Wire and Conspiracy statutes. Also, the USA believes venue 
could lie in the FDVA since GTE in Vienna, Virginia operates the Tele- 
mail system nationwide and has thé capability to monitor the entire 
Telemail system. . 


Close liaison will be maintained with appropriate GTE per- 


sonnel and Alexandria will continue their investigation regarding 
this matter. 
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RE ALEXAMDRIA TELET YPES TO DIRECTOR, auust 27, 1983; AUGUST ‘30; 


1983, AND exeremsen’ 2 965, AND AX TELCALL TO 
CFB IHG) , 9/6/83. ma S46 = YU) Bo we 


FOR INFORMATION OF THE BUREAU AND DETROIT, INVE STIGAT 10 N IN 
THIS MATTER HAS REVEALED SIGNIFICANT, “EXTENSIVE INTRUSIONS INTO «> 
“Aw UNAUT.HOR IZED USE OF GTE'S TELEMA LL. SYSTEM BY AT “LEAST THREE, 
SEPARATE GROUPS OF "HACKERS" CINNER CIRGE, PHAL SERS 3. AND “WAL KECO N)« 
THESE “ HACKERS" WORK IN- 00 NCERT WITH EACH: OTHER y SHAR tie INFORMATION . 
IN METHODS BY WHICH ACCESS IS” GAINED INTO THE -accouit's OF 


“4 SEP 8 1982 
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LEGITIMATE TELEMA. CUSTOMERS. THE “HACKERS” HAVE CREATED THEIR 
OWN FRAUDULENT ACCOUNTS. AM AT LEAST 29 KNOWN TELEMAIL ACCOUNTS ' 
AND HAVE CAUSED THE TERMINATION OF TWO LEGITIMATE CUSTOMERS 
(COCA-COLA, USA AND RAYTHEON COMPANY). : _ 
GTE WAS DETERMINED THAT THE HACKERS HAVE HAD. Access 10 THIS 
SYSTEM SING: AT LEAST EARLY JULY, 1983,. ND THE INITIAL 
ESTIMATE OF LOSS WAS $20,000 PER MONTH, AND THIS WAS BEFORE THE 
DSOOVERY OF THE LAST TWO GROUPS. (PHAL SERS AND WIL KEOON) AND THE 
TERMINAT ION OF THE RAYTHEON ACCOUNT ON aucusT. 29, 1983. [7 | . 
CY OR THE TELEWAM SYSTEM, IND TATED Bre 
THAT IF ANOTHER AGCOUNT IS TERMINATED BY THE "HACKERS," THE 
ENSUING LACK OF CUSTONER OO NFIDENCE IN TELEMAI: COULD RESULT 
IN MANY SUBSCRIBERS WITHDRAWING, FURTHER RESWTING IN THE LOSS OF 
THE ENTIRE TELEMAIL PROGRAM. ; 
LWE STIGAT ION BY DETRO IT esa HAS POSIT IVELY bs ° 


DENTIFIED ONE OF THE PRIME SUBJECTS as[_—s+# AKAs. __—*itY ere 


THIS “HACKER” IS A PART OF THE INNER CIRCLE AN THE WILKECON GROUP. 
DETROIT HAS FURTHER BEEN OF GREAT ASSISTANCE IN THIS MATTER THROUGH 
INFORMAT ION PROVIDED BY A CONFIDENTIAL SOURCE. “THE SOURCE IS - 


[or saw sf 7 


 #% 7% 
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ALEXANDRIA HAS BEEN WORKING WITH GTE To TRACK THE TELEMAIL 
INTRUSIONS BY THE HACKERS. “AN EXTE NSIVE LIST OF USER ‘NAMES 
 CUSUALLY, FAaL SE) AND TELEPHONE AREA CODES HAVE BEEN DEVELOPED. 
‘IY I$ THOUGHT THAT. A MEET ING BETWEEN ALEXANDRIA FBI, GTE’ PERSONNEL, 
ato sal JAD HIS SOURCE WOULD BE. EXTREMELY PRODUCT IVE, IN 
TERMS OF IDENTIFYING THE REAL IDENTITIES OF MANY OF THE.""HACKERS,” 
ACCORD INGLY, BUREAU APPROVAL IS REQUESTED FoR sal __—id 
WETROIT) AMD HIS SOURCE TO TRAVEL TO ALEXANDRIA ON OR ABOUT 


be 
b7¢ - 


SEPTEMBER 7, 1983, FOR A SERIES OF MEETINGS WITH ALEXANDRIA FBI 
AWD GTE PERSONNEL. , , 
SAC DETROIT AND’ SAC ALEXANDRIA: CONCUR. 
VERBAL AUTHOR IZATION GRANTED BY. FBIHQ IN RE TELCALL. 
BT 


BT 
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‘PAGE TWO AX 1964-633. UNCLAS- oe 
UNAUTHORIZED ENTRY INTO GENERAL. TELEPHONE AND aLEcTRostes corey 


TELEMAIL ‘SYSTEM; FRAUD BY WIRE; CONSPIRACY (00:A% _ 
TITLE CHANGED: TO INCLUDE ADDITIONAL SUBJECTS AND ALIASES, TITLE” 


PREVIOUSLY CARRIED aS UNSUBSs AKA[ 
- - Sf pre 


" OPERATIONS CIRCLE} UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND 
ELECTRONI %S (GTED ‘TELEMarL SYSTEM; FRaUD BY WIRE} CONSPIR-ACY (002 AX). 

RE ALEXANDRIA TH-ETYPE TO DIRECTOR, AUGUST 27, 1983. © 

FOR INFORMATION OF THE BUREAU AND ALL RECEIVING~ OFFICES, 

REVIEW OF TELEMAIL SECURITY LOGS BY. GTE INDICATES THAT AT LEAST 17 | 
LEGITIMATE USERS OF TELEMAIL HAVE BEEN PENETRATED BY CAPTIONED - 
SUBJECTS. IN ADDITION THREE TELENET INTERNAL SYSTEMS AND. ONE FIRM 
IN CANADA HAVE BEEN PENETRATED. ; 

IWESTIGATION INDICATES THAT THE "PHALSERS” IS A - GROUP viTK SOME 
KNOWLEDGE OF AND POSSIBLY CONNECTED TO THE.“ INNER ‘giRcLE™. “THE 
CONTENT OF “PHALSER” MESSAGES INDICATES OLDER PERSONS (THAT IS, NOT 
TEENAGERS) WITH MORE SOPHISTICATION THAN LNNER CIRCLE: MEMBERS, © 17 
IS THE OPINION OF GTE SECURITY PERSONNEL THAT ONE OR MORE OF THE 
PHALSERS CAUSED .THE TERMINATION OF TwO ENTIRE TELEMAIL ACCOUNTS, ONE 


“PAGE THREE AX 196A~633 UNCLAS : 
OW AUGUST 25, 1983, AND ANOTHER ON AUGUST 29, 1983, TELEMAIL, AS. 
WELL AS THE AFFECTED USERS, -SUFFERED etc ere ee DUE- 
TO THOSE TERMINATIONS, 4 : 

ON AUGUST 30, 1985, saa x NRE WET WITH 
USA ELSIE L. MUNSELL, EDVA, AND DRAFTED A PROTOTYPE COURT .ORDER 
‘FOR TRAP AND TRAGE DEVICES AND A SUPPORTING AFFIDAVIT, - THESE Two 
DOCUMENTS WILL BE FACSIMILED FROM THE-USA, EDVA, TO THE USA’S OF THE 
SOUTHERN DISTRIGE OF NEW YORK, EASTERN DISTRICT OF NEW. YORK, DISTRICT 
OF MARYLAND, EASTERN DISTRICT OF MICHIGAN, AND SOUTHERW DISTRICT oF 
“GALIFORNIA, THEY ARE DESIGNED SO THAT THE CASE AGENT AND EACH FIELD 
OFFI CAN SIMPLY FILL IN HIS NAME, FIELD OFFICE, NAME OF THE 
TELEPHONE COMPANY, -AND TELEPHONE MIMBERS PROVIDED BY ALEXANDRIA AND - 
THEN PRESENT: TO A UNITED STATES DISTRICT JUDGE, ; 

THE NUMBERS TO BE PROVIDED. ARE “TELENET NETWORK DIAL IN" 
NUMBERS THAT ARE BEING USED ‘BY-UNSUBS TO-ENTER THE TELEMAIL SYSTEMS, 
ONCE LOCAL PHONE COMPANIES HAVE BEEN SERVED wITH COURT ORDERS AND’ 
TRAP AND TRACE PROCEDURES ARE IN PLACE, THESE STEPS WILL TAKE-PLACE: = © 

fy TELEWAIL WILL BEGIN REAL TIME MONITORING. OF ‘THE ACCOUNTS 
USUALLY “ACCESSED BY UNSUBS. 


23 WHEN UNSUB IS DETECTED on ONE OF THE NUMBERS PROV IDED ‘TO 


PAGE FOUR aX 1960-633 UNCLAS , , - 
FIELD OFFICES, a sl) se 
[AL x aNDRIA WILL IMMEDIATELY CALL THE APPROPRIATE PHONE pic 
COMPANY SECURITY:MANAGER CUSING NAME’.AND NUMBER PROVIDED BY EACH 
FIELD OFFICE TO ALEXANDRIA) AND REQUEST INITEATING OF TRAP AND TRACE 
TO DETERMINE HOME PHONE NUMBER .OF UNSUB. 

3, THE IMWOLVED FIELD OFFICE WILL. THEN BE CONTACTED AND ADVISED 
OF THE CALL.. THAT FIELD OFFICE WILL BE EXPECTED TO OBTAIN ANY 
INFORMATION GAINED FROM THE TRAP AND TRACE AND PROVIDE SAME To 
ALEXANDRIA. FOR INFORMATION OF ALL. OFFICES, AREA CODE 315 15, USED 
MOST OFTEN BY[ >. AREACODE 619 IS USED syL___} AND 
oceastona.ty[ “AREA CODE 914 IS USED ‘ay amp. area” ; 
CODE 212 Is useD By[___——=sd#R FOR FURTHER INFORMATION OF NEW Se 
YORK IWESTIGATION Has REVEALED THaT[_ |MaY BE IDENTICAL. To 
[_} TELEPHONE. suMBER[ 

LEADS: AT THIS TIME ALL RECEIVING OFFICES ARE REQUESTED To: 

1, CONTACT THE usats ‘OFFICE AND ALERT THEM To THE INCOMTNG’ 
FApSIMILE OF THE COURT ORDER FOR TRAP AnD TRACE AND SUPPORTING 
AFFIDAVIT AND OBTAIN NAME OF AUSA HANDLING.THE MATTER IW YOUR 
DISTRIG. - oS : 


2. AS SOON AS POSSIBLE, NOTIFY LOCAL PHONE COMPANY OF SIGNING 


“PAGE FIVE. AX 196-635 UNCL AS” a 
OF COURT ORDER- AND HAVE PHONE COMPANY INSTITUTE TRAP “AND “TRACE 
_ MEASURES OW NUMBERS PROVIDED. 

3. NOTIFY ALEXANDRIA BY TELCALL WEN TRAP AND TRACE 
‘PROCEDURES ARE READY IN YOUR DIVISION. — 

“4.° PROVIDE ALEXANDRIA CATT We ssL____} WETH THE NAME AND. 
NUMBER OF PHONE COMPANY ‘SECURITY PERSON TO BE-CALLED WHEN AN , 
UNAUTHORIZED ACCESS IS DETECTED BY GTE, 

5, -ALERT PHONE COMPANY SECURITY THAT THE GALL WILL BE COMING 
Pow. @PED I CTELEPHOWE NUMBER 
[Jor (7) on’ ssf Jenene ta PHONE 
NUMBER 703-685-2689). CAT THIS TIME, REAL TIME MONITORING BY 
GTE WILL BE FROM 6:09 AM TO 5:00 Pi, EASTERN DAYLIGHT TIME.) 


& PROVIDE ALEXANDRIA WITH NAME AND EXTENSION OF CASE AGE NT To: 


BE NOTIFIED IF TRAP AND TRACE INSTITUTE IN HIS. DIVISION. 
TELENET DIAL IN NUMBERS AVAILABLE AT THIS TIME “ORE AS FOLLOWS? 


BALTIMORE? AREA CODE, PREFIXES 962, 727, 224, FULL NUMBERS To 


FOLLOW AS SOON AS POSSIBLE. 
DETROIT: AREA CODE 313/964-2813, AREA CODE 313/964- ~5538. 
NEW YORK (SOUTHERN DISTRICT) : 914/328-9199, 914/328-9163, 
914/ 528-) “3161, 914/328-9162, 914/328- 5163. ; . : 


bé6 
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NEw YORK CEASTERN DISTRICT OR SOUTHERN DISTRICT): 212/785-3865, 
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ATTENTION: SaL___} SquaD SEVEN, BaLTIWORE 


ATTENTION: Sal DETROIT 


ATTENTION: Sal} Sai’ DIEGO: . . 


aiTention: sa[L__b 4 


PgGE TyO aX £96q-35 UNCLAS _ oo ‘ 


s 


..GIE) TEREMAIL SYSTEM: FBy, CONSPIRACY, (OOZALEXANDRIA? 


TITLE CHANGED TO. INCLUDE aDDITIONAL SUBJECTS aND ALISES, 


— 


RE gLEXaNDRIq TELETYPES TO THE DIRECTOR DATED AUGUST. 27, 1983, 
AND AUGUST 36, 1983.° (COPIES OF REFERENCED TELETYPE ARE BEING 
AIRMAILED TO OKLAHOfMg CITY gND BALTIMORE. ALSO BEING’ ‘4 IRMAILED 
TO OxLaHOM, CITY gND BaLTINORE qRE q PROTOTYPE COURT ORDER AND 
AFFLDAVIT SUPPORTING THE COURT ORDER.FOR qa TRaP AND TRACE ON 


DESIGNATED NyMBERS..) ; 

INFORMATION COPY BEING PROVIDED BOSTON BECAUSE IT is 
ANTICIPATED THaT INTRYDERS WILL-BE IDENTIFIED IN THaT AREA AND 
GIE TELEWgIL Digh-IN WyMBERS IDENTIFIED IN THE NEAR FuTURE. 

FOR INFORM, TION OF THE BUREAU AND ali RECEIVING OFFICES, A 


PAGE THREE aX 196q~33 UNCLaS — , ; 
THIRD CIRCLE OF INTRUDERS (THOSE qDDED TO TITLE LW THIS. TELETYPE) 


HaS BEEN IDENTIFIED BY @TE. - THESE SiB JECTS ARE ALL CONNECTED WITH’ 


(7) uO gPREARS TO BE OPERATING UNDER, THE 405 AREA 


CODE COKLgHOMg CITY aREg) aND USES THE vane [___]csto i ror[_] 
‘Lp FOR HIS GROUP. . 
| THE FOLLOyING 1S q LIST OF TELEtia iL USER COMPANIES KNOyN 70 
HaVE BEEN PENETRATED BY ONE OR MORE OF THE THREE iit: GROUPS 
GNNERCLACLE, PHaLSERS ort | aMERICa® HOSPITAL SUPPLY; BH; 
COCA COLA USa3 EDUNETs NgTIONgL SYSTEMS MyNAGEMENT., INCORPORATED; 
RAYTHEON3 NaSa3 JET PROPULSION LaBO Ra TORLES $ THE, INCORPORATED 5 
3M COMPANY; TLIMECOR; TRys HUBHES ALRCRAFT CORPO RATION 5 ‘NORTHROP 
CORPORATION; yNITED STATES DEPARTMENT OF AGRICULTURE ; Buys HARAVEN 
CORPORATIONS TIL SYSTEMS (CaNpDI a); Rada; IN ADDITION TO THR 
INTERNAL GTE TELENET ACCOUNTS. ONE OR WORE OF THE GROUPS Has 
4LS0 PENETRATED ITT DIALCOM, THE SOURCE, CONPUSERV AND TIMENET, 
ALL OF yHICH gRE ELECTRONIC NESSqGE NETWORKS TOTALLY INDEPENDENT 
FROM GTE*S TELENAIL. , : , 
THE PHALSERS HaVE-glSO GAINED gCCESS TO-THE DOD.,RP-NET 
SYSTEM. IN A MESSgGE ON quGUST 28, 1983, ] DESCRIBES 
THE DEFENSE ADVANCED RESEARCH PROJECTS. AGENCY iN DETAIL, TO 


b6 
b7C 


b6 
b7c 
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INCLUDE THE DARPE Hq BUILDING LOCATION, FTS LOCATOR KUNBER, AND 
THE NAMES OF THE DIRECTOR AND DEPUTY DPRECTORaND-SONE OF ITS 
RESEARCH PROJECTS TO INCLUDE: “NUCLEAR MONITORING RESEARCH, 
LAZER BEN ND PaRTICLE TECHNOLOGY.” aND OTHERS. 


ON AUGUST 29, 1983, __JLEFT q message To. __—siAND 


TL JTItiep “array ann OTHER ODDITIES" aND READING “aS FOLLOWS: Bre 
“SOME OF THE INFO IS DaTED BuT WOST IS STILL 600D ‘TO USE. DoD 
PENTAGON FTS CERTREXESR:: 6925-693, 694, 6955 696, 697. AUTOVON 
INBOYND EXTENSIONS ARE: 222) 223, 2247 225, 226, 227. -USE EIGHT 
TO INETIATE ayTOVON aCCESS, BE C@REFUL ON THIS, THEY WONITOR-IT 
EXTENSIVELY. OTHER ijgSH BC AREA CENTREXESR: .CAPITOL = ‘225, 
Clat 351-1100, yH.SHE.: 395, GSaz. 472, GSFC: "982, IRS? oo, 
556-5600, FCC: 632, NaSat 795, NRO: 492, SECSSRVC.: "634-5100," 
SEL.SRVCs: 724-0424.. WEATHER: © 655-4090." 
ALTHOUGH THE ‘~BOVE INFORMaTION MgY-NOT BE cLassiFizD, it 
INDICATES THaT THE INTENT OF THESE SUBUECTS 15. TO PENETRATE aNY 
AND EVERY COMPUTER SYSTEM.THEY CaN aND TO DEVELOP ADDITIONAL r 
WAYS’ OF ILLEGALLY aCCESSING LONG DISTANCE PHONE: LINES (THEY 
ROUTINELY USE STOLEN SPRINT OR MCT LONG DISTANCE CODES). 
10 FURTHER ILLUSTRATE THE INTENTIONS OF THE PHaLSERS, THE 3° 


PaGE FIVE aX 1964-33 UNCLAS a 1 . . . 
FOLLOWING MESSAGE IS-PROVIDED GTE ND CHaNGED THE PASSWORD OM aN 
INTERNgL SYSTEM, PREVENTING ]FROM USING IT... HACKERS CALLED 
THal BEING BUSTED.) WESS,GE 1S FRom[_ |] To PHALSERS ON, pre 
JULY 18, 1983. SUBJECT: "ANOTHER FuCkING ByST” “TEXT: hy 

PRIVATE qREA I HqD SET-UP OW EVAL GOT TakEW DOyH TODAY AND 1H 
FUCKING PISSED gBOyT IT IF 1 GET ENTO SYSqDM You ScuMAGS AT 
GTE TELENET ARE FINISHED SIGNED THE imqTE[—=sS#ébI™”=séFOR 
INFORMATION, aCCESS TO "S¥SqDM" WOULD aLLOy 4 PERSON fo DISRUPT ° bé 
THE EWTIRE TELENET TELEMgIL SYSTEM. . ne 


ON aUGUST 31, 1983, IN q MESSgGE TO HIS ckoyP,) SSSS—~™dS : 
INDICATED HE yaS TO BE INTERVIEWED BY q NEWSPQPER REPORTER ON 
SEPTEMBER 1 OR 2, 1983, CONCERNING PHONE "PHREA KING ‘AND HACKING’. 
FURTHER, IN q Ma@ssaGe FRoN[D—rofD —idiow 6 
AUGUST 32,1983, /12:57 ail,[_____STaTED THaT HE (C__b woud | ee 
BE FLYING INTO “OKC” qIAPORT..OW qMERICAN AIRLINES ND ARRIVING 
AT APPROXIMp~TELY 1:02 PM ON TUESDAY, SEPTEMBER 20, 1963. THIS 
MESSAGE IS SIGNED. SSCSC~C~SCSCSCSFAT: sd AN ON , 
AUGUST 34, 1983,[__JLEQ VES a. MESSAGE to[__]savine HE yILL ae 
BRING SOME GOOD TAPES gND "HOOCHIE™ THROUGH THE-alRPoRT. [| , 
ENDS THIS MESSgGE BY SaYING “I'M FEELING REAR AAAALLLLLLLL* G00D, 
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Ya xNOy". gT i468 aM, queusT 39, i983,[__ ]sato tol} 


“THROUGH THE aiRPORT?? “YOU THINK ~ KILO wOULD BE A.BiT. OBVIOUS. 


I'M NO JOHN DELOREAN Yq KNOw” aT “1:39 aM, AUGUST 30,1983, 7 
[_|saip rc “wHal HAPPENS WHEN THE DOGS FAT MY LEB.2T ps 
at TRIS TINE, aLEXgNDRIA HS NO wg¥ OF. DETERA NING THE CREDIBILITY, ere 
OF THE REFERENCES TO DRUGS IN @BOVE QUOTES SINCE THESE “HaCKERS" 

@RE PRONE TO EXqGERATIOW IN THEIR COMMUNICATIONS. 17-18. CLEAR, 

HOWEVER y Tal La OTHERS INL _]@ROUP RE 

CHRONIC INTRYDERS INTO THE GTE TELEVET SYSTEM. — 

INVESTIGATION HaS REVEQLED THal TyO° TELEPHONE WUMBE Rs GIVEN ne 
BY[__J10 OTHERS IW THE cipcLz are Jaso[> _} | BTC 
THESE NUMBERS MaY BE SuBSCRIBED.To BYL__JaNDL_——sSS—S—siOS! oe 
IS ySING THE FOLLOWING TELEVET Digi! aiD wutBeRss [+ - 

LEADS: OxLgHOtig CITY. 1) UPON RECEIPT OF Copies oF” 
REFERENCED TELETYPE qND PROTOTYPE COURT ORDER aNO AFFIDAVIT, WILL 
INSERT LOCAL DAT, AGENT*S igME, LOCAL TELEWET DIAL-IN NUWBERS, 

PHONE COMP gNY NAME, ETC., ‘AND CONDUCT LEADS aS SET OuT FOR ALL - 


OFFICES IN gLEXqNDREg TELETYPE TO THE DIRECTOR, AUGUST "30, 1983," 


“PARE SEVEN aX 196 Doscuss ® ey 


2) WILL CONFIRM SUBSCRIBER INF ORMg TION FOR TELEP HO NE HUNBERS - 


Lo aio 

3) ILL CONT@CT AWWERICAN AIRLINES qND aTTEMPT TO- VERIFY 
RESERVATIONS FOR SEPTEMBER-29, 1983, BYL_—~—~—SCSCS@d 
OR VARIATIONS) FOR-q FLIGHT ARRIVING al APPROXIMATELY 1:00 PN 
ON THaT DATE. HOTE THaT THE NaNeEL___|MAY BE AN alias’. 
REFERING TO KEY BISCaNE, FLORID, .) 

4) ILL REVIEy LOC aL NEySP aPERS FOR aNY RECENT ARTICLES 
ON “HACKING OR PHONE PHREAKING” WHICH MaY GIVE INDICATION OF 
IDENTITY OF qNY OF THE gBOVE=MENTIONED PaRTICIPANTS. 
BI 


be 
b7c 


ey, 13 19452 SEP 83 / 

j FM OKLAHOMA CITY “asesfiere cpr 
TO DIRECTOR, PBL  PRAORITY 
ALEXANDRIA (196A-633) IMMEDIATE 


FB 5 QONSPIRACY; OO: ALEXANDRIA. 


ALEXA NDR TA ca oe aup oTHers,. septemser (01 sk 

OKLAHOMA CITY HAS DETERMINED FROM CONTACT WITH 
DO Jorrictars THAR THEY WOULD. PREFER THE 
TRAP AND TRACE THROUGH THE USE OF A COURT ape adee 


1983, A COURT ORDER WAS OBTAINED, SIGNED oe [26 district JUDGE UDGE 


bIE 


DAVID RUSSELL, WDO, OKLAHOMA CITY. THIS ORDER WAS-SERVED THIS 


. PACE THO ; OC 196A+127@ “UNCLAS” 


cowtact wits ——~™—CCOFFEGTALS HAVE DETERMINED 


THAT ALEXANDRIA SHOULD FURNISH. ON A-DAILY BASIS TO OKLAHOMA CITY 


a 


THIS INFORMATION SHOULD BE FURNISHED To ’sa[__———sd#’ AD 
IF SAL___]1S _80T AVAILABLE, THE INFORMATION SHOULD SE FURNISHED 
to sal ~~—ijor supsrvison(__S—CéidS;C 


OKLAHOMA CITY, UPON RECHIPT OF INFORMATION FROM ALEXANDRIA, 


FOR THE FURTHER INFORMATION OF ALEXANDRIA, INQUIRY AT THE 


UBIVERSITY OF OKLAHOMA, NORMAN, OKLAHOMA, DETERMINED tueTL | 


[isa proressop us[ RECORDS IN 
THE REGISTRAR’ S OFFICE aLsO INDICATE THaTD ——sdiA SD 


BIE 


bIE 


be 
b7c 


OKLAHOMA AT NORMAN. : ey yee ° : 
feat eat ia ‘ b6 
; OKLAHOMA-CITY. 1S MAKING NO FURTHER: DNoUTAY coxcerntue{___] b7c 
[Jat tuts TIME PEND ENG THE OUTCOME OFT! 


ACTIVITY, 


7AP AND. TRACE 


ALEXANDRIA, AT ALEXANDRIA, VIRGINIA - WILL “FURNISH To 
OKLAHOMA CITY ON A.DAILY.BASIS THRORMAT IO W890 “As TO ALLOY TRAP AND 


TRACE PROCEDURES TO BE. COMPLETED, I THE OKLAHOP 


BT 


yg er arin id 


ny : vd * 


“ axogle 256 @436z @ an po a 
a : : RECEIVED ° 
00. HG AL BA BS BU DE LA wy TERESA PRY! 


igh 888 108 Ie 


Any P43 21882 SEPT 53 : 

Ne : 

! i FM ALEXANDRIA -CIS6A+633) ¢ 
B : oi ei omy, 4 


TO DIRECTOR PRIORITY 7 a ~ . assem of 
ALBANY IMMEDIATE 
BALTIMORE ROUTINE “CINFOD | 
BOSTON ROUTINE. CINEO) 

. BUFFALO. IMMEDIATE 
DETROIT ROUTINE CIMFOD 
Los ANGELES IMMEDIATE: 
KEW YORK. ROUTINE (INFO) 
OKLAHOMA CITY IMMEDIATE 


OM AHA THMED LATE 
_ PHOENIX IMMEDIATE. 


“SAN DIEGO ROUTINE.CINFO): / Fhe Wa: 


a2 , SEP 21.1983 
CONSPIRACY COs SAX 1 : ° 


8T 


UNCLAS 


SHANGER 


TITLE cope. BANE £08 THIS. case: _ TITLE 


bé 


Sw pas 
8D NOY 25 1983: 


b7¢c 
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PREVIOUSLY CARRIEI * pen ‘anal 
b7C 
Se AKA AL$ UNAUTHORIZED ENTRY “iNto GENERAL 


* TELEPHONE AND ELECTAO WTS . (GTE). TELEMAEL SYSTEN; FRAUD BY. WIRES 


CONSPIRACY. (0 2AK)". : 

RE ALEXANDRIA TELETYPE 16 DIRECTOR, wd 215: | ee 30, 
AND sepreneen eh 2, 1983. (COPIES OF REFERENCED TELETYPES BEING 
“AIR MAILED TO ALBANY; BUFFALO, Los ANGELES, OKLAHOMA CITY, 
OMAHA AND PHOENIX.) . 

FOR INFORMATION OF BUREAU AND ALL RECEIVING "OFFICES } 
INVESTIGATION. HAS IDENTIFIED 18. DIFFERENT SUBJECTS, EACH USING 
AT LEAST OWE (SOME aS MANY AS FOUR OR FIVE) ALTASES, WHO ARE 
CONTINUOUSLY ACCESSING GTE TELEMAIL. 

> 66) us 
[For THE “INWERCIRCLE”, AND ILLEGAL TELEWAIL ELECTRONIC 
"MAIL BOX", WHICH HE CREATED AFTER BREAKING THE PASSWORD FOR 


’ AMERTCAN HOSPITAL ‘SERVICES CORPORATION, & LEGITIATE. TELEMAIL 


USER... ; ; : ; 
HE THEN CREATED “USER “ACCOUNTS” IN THIS MAIL BOX’FOR A NUMBER 


- “ b6 
OF useRS IncLuDinG ¢ [CVA re 


OTHERS. 
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Coys wow[ For an TLLEGAL: ACCOUNT CALLED TRIPLEX, 
WITH THE FOLLOWIne users: ——S—CS—CS—SS—SCCC~C~*Y - bé 
et . me 
ee [C: PROBABLE ALIAS) CREATED Two ILLEGITIMATE 
ACCOUNTS. IN THE LEGITIMATE ACCOUNT OF BNW CORPORATION AND CREATED 


- bIC 


2 ACTIVE. . 
ZL 


LS idics PROBABLE ALIAS) CREATED USER ACCOUNTS IN 


A LEGITIMATE ORGANIZATION NAMED RADA AND CREATED AN ILLEGAL ACCOUNT 


cai.LED —_|cron[__ Ie RADA. HIS USERS ARE: 


bE 
b7c 
"THERE ARE TWO OTHER ILLEGAL ACCOUNTS WHOSE SYSADM ARE UNKNOWN 


: FOR INFORMATION OF BUFFALO,[ _ |(FEMALE, WITH Two pic 
CHILDREN): anD[——=C*diCMNALEE, POSSIBLY A REAL ESTATE: SALESMAN) 


PAGE, FOUR AX 1964-633 UNCL AS. 
CONSISTENTLY ACCESS. TELEMAIL THROUGH TELENET DIAL-IN NUMBERS 


[5 ss 


_THE CONTENT OF THE MESSAGES INDICATED THAT[_ |HaS JUST BEGUN 


COLLEGE cLasses.[_____—=sdYPREVIOUSLY USED THE namEL_ sd sobs 
. . bIC 
aun.—ss—~—~—“‘*™CSCS OHIS MESSAGES INDICATE HE MAY BE ASSOCIATED ; 


WITH..A HOME BUILDER, PossiBLy[__——=sdi{«sTN A SALES “CAPACITY. 
FOR INFORMATION OF aLBawy,[ __]SENDS MESSAGES To 


DIAL-IN NUMBER (THAT IS, HE DOES NOT HAVE TO CALL FROM ANOTHER , 6 


. . ‘ b7c 
‘ NUMBER). ASSIGNED TO CORNELL UNIVERSITY. 


THIS. suMBER IS[_—S*d 


[  Jnessacés. ALSO INDICATE. HE. IS HOW IN COLLEGE. HIS 


roowmate ts[_____ wu anp[-__Juses THE name> _—=d;EN 


“HTS COMMUNTEATIONS 


FOR INFORMATION OF PHOENIX AND OKLAHOMA cry,[ 
‘[__]sewos most oF HIS messages to[__Jor-______]aeo T—_] 
iS CALLING From. THE[_} AREA’ USING TELENET DiaL-1 > 
womeer [._—*dSONTIiums To MENTION A TRIP TO-VISIT. - pre 
[IN oxLanonas 


CITY OR, NORMAN, OKLAHOMA, AND THAT HE, WILL BE 
BUYING. MORE “HOOCHIE"” 


(MARIJUANA) TO TAKE WITH KIM ON THAT TRIP’: 
SPECIFICALLY[__ [STATED HE. WAS. GOING TO FLY INTO OKLAHOMA CITY 


PAGE FIVE ax 1964-633 UCLAS : 
"AIRPORT ON SEPTEMBER 20, BY AMERICAN AIRLINES AND ARRIVE AT 
APPROXIMATELY 1:00 PU. ; 
FOR’ INFORMATION OF OXLAHOWA CITY;[__]HaS. BEEW REFERRED 
“TO In.meSsaces aS[_ AND LIVES WITH HIS FATHER. FURTHER, 
REVIEW OF HIS MESSAGES INDICATE THE MAILING ADDRESS’OFL__] ve 
7 ts rerenncn 
TO AS A "REMAIL” aDpREss.[____Jaup[-___—=SdiBOTH UE 
[___]aS A DIAL~IN NUMBER AND THEIR MESSAGES THDICATE THEY 
_KWOW AND VISIT, EACH OTHER. DETROIT SOURCE ALSO PROVIDED THE 
eee 
: Foy. Mahe 
SSS SSeS ey bre 


‘ “b7D 


DETROIT souRCE ALSO state THat[—————] 
FOR INFORMATION OF Los aegies,[— aga oe 
[__} 18 kNGwN TO. HAVE @ FIRST Name OFL THE DETROIT source °. 7 
“pro v3pep [—— 
: : : 6 
a ee | bic 
Sooo —_ ee _ 
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[-} accorvine to THe petro1t source;[ Sd 
bE 
bt 
a : : : b7D 
eee: ¢me 
_ FOR. INFORMATION or-omaua,[ SSCS axa 
IS APPARENTLY Doina BuSIwess asf 
Pro tor 
CTF ses piaL-1n wumeer [7 } ann Leaves anon 
"MESSAGES FORD] AND OTHERS Iw THE |eroup. *! _ 
FOR INFORMATION OF SAN DIEGO,[ _——=sdLEAVES MESSAGES FOR 
[J aup THE TRIPLEX Group awp[__ Jan THE[___]eRouP. 
. FOR INFORMATION OF BALTIMORE, NO FURTHER COMMUNICATIONS FROM 
[Cd HAVE BEEN NOTED FROM THE 301 AREA CODE. 
. FOR INFORMATION. OF MEW YORK, INVESTIGATION HAS REVEALED THAT . : pe 
[is canting TeLemarL From[7sob-& NUMBER WITH 
SUBSCRIBER INFORMATION as FoLLowSe[ SOC 
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—— 


IS THOUGHT.T0 BE[__—sdiS «WITH A HOME PHONE OF. ——sLI'STED.. 


to} verre source ins] 


_ ae 


FOR. INFORMATION OF ALL OFFICES, UNITED STATES ATTORNEY, EASTERN 
DISTRICT OF VIRGINIA, INTENDS TO: BRING CRIMENAL PROSECUTION. AGAINST 
SLL PARTICIPANTS. Ii THIS’ MATTER. EARLIER OFFICES INVOLVED WERE 

REQUESTED TO GET SROURT ORDERS FOR TRAP AND TRACE IN ADDITION TO OR 
IN LIEU OF A CUSTOMER REQUEST On THE RECOMMENDATION OF USA, EDVA. 
HOWEVER, SOME OFFICES REPORTED THAT THE LOCAL TELEPHONE COMPANIES 
- INDICATED THAT A CUSTOMER COMPLAINT WOULD BE MORE EXPEDIENT. 
THEREFORE AT THIS TIME COURT ORDERS FOR TRAP -AND TRACE ARE NOT BEING 


REQUESTED, BUT RATHER ALL OFFICES ARE REQUESTED TO GIVE THE NAME OF 


THE PERSON AT. THE TELEPHONE COMPANY THAT aTToRNEY[___} STE, 
MAY CONTACT TO REQUEST, ON THE BEHALF OF GTE, THAT A TRAP AND TRACE 


BE INSTITUTED. FURTHER, IF A LOCAL TELEPHONE COMPANY HAS A PARTICULAR 


FORM WHICH NEEDS TO BE EXECUTED, BACH OFFICE WILL IMMEDIATELY 
FACSIMILE SUCH FORM TO ALEXANDRIA 70 BE SIGNED AND RETURNED BY GTE 


PERSONNEL. . 


b6 
b7c 
b7D 


b6 
b7c 
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LEADS: ALBANY 47 ITHICA (CORWELL UNIVERSITY): WILL OBTAIN 

SUBSCRIBER INFORMATION FOR TELEPHONE womBER[ 6 
BUFFALO AT ROCHESTER, NEW YORK: 1. WILL’ NOTIFY LOCAL TELEPHONE 


COMPANY SECURITY MANAGER THAT} ATTORNEY For 6TE 


TELEMAIL, VIENWA, VIRGINIA, WILL CALL TO REQUEST TRAP AND TRACE OW Pe 
wuusgrs———S—S—~swd aD S~S~*~—CCCS STO BE FOLLOWED BY LETTER 

OF CONFIRMATION OR. EXECUTED FORM, IF PROVIDED BY PHONE COMPANY. 

2, WILL PROVIDE ALEXANDRIA WITH THE. AME AND PHONE NUMBER OF PERSON - 

TO BE CONTACTED AND DIAL-IN NUMBERS JO BE GIVEN TO. THE LOCAL. TELEPHONE 
COMPANY’ FOR TRAP AND TRACE. “3. WILL PROVIDE ALEXANDRIA WITH 
“SUBSCRIBER INFORMATION ON ANY NUMBERS OBZAINED BY THE TELEPHONE 

COMPANY FROM TRAP AND TRACE. 4. WILL aSCERTAIN TR[L__—idiIs a 
BUILDER IN THE ROCHESTER AREA AND DISCRETELY. INQUIRE ABOUT A. OE 


b7C 
SALESMAN WITH FIRST nome oF[_lor[__ |} 
PHOENIX AT TUCSON, ARIZONA: WILL CONDUCT LEADS NUMBER 1, 
2 AND 3, AS SET OlT FOR BUFFALO, USING -DIAL-IN. numBER [1 
| LOS ANGELES AT LOS ASGELES: 1... WILL CONDUCT LEADS NUMBER 1, os 


2 AND. 3, AS SET OUT, FOR BUFFALO, USING DIAL-In NuMBERS[ Oh OB7E 


Cann [7 —S*&YS:C 88, WIL coNnFERM SUBSCRIBER INFORMATION 
OW. PHONE sutaers [Jano [___} aso attenpr to 


OBTALN.AN ACCURATE HOME ADDRESS ror Jasovorn(____} 


OWAHA AT. OMAHAs- 1. WILL CONDUCT LEADS. .WUMBER 1, 2-AND 3, _ 


AS SET OUT FOR BUFFALO, USING DIAL-IN numBERL sds. WELL 


CONFIRM SUBSCRIBER INFORMATION ON[ ____JAND ‘OBTAIN SUBSCRIBER ve 


. - b7c 
INFORMATION ON[ sd. 


NEW YORK AT STONYBROOK: [. | WILL CONDUCT DISCRETE INVESTIGATION 
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“TO DETERMIN® wHETHER[____]IS" A. DORMITORY OR CLASSROOM BUILDIMG. 

2. ATTEMPT TO OBTAIN ADDITIONAL “IDENTIFIERS ON[ +d: 

3.° WILL CONFIRM SUNSCRIBER INFORMATION on Jain ATTEMPT , 

TO DISCRETELY: DETERMINE ve [eves aT THAT ADDRESS. 
OKLAHOMA CITY AT NORMAN, OXLAHOMAS 1, WILL OBTAIN ANY he 


IDENTIFIERS ASSOCIATED a —_ b7c 
TELEPHONE wumBeR [ano 
[t~—“C;™C__} TELEPHONE NUMBER Ss 2 
ie 
DETERMINE IF A PROFESSOR WITH THE /wane[ Jor — 


ON THE FACULTY. AT UNIVERSITY OF OL, RHONA 
BT 


i | : . ’ - - . . \ 


axOG17 25201362 © @ 
PP Hg 


DE AX 
oe P 9921382 SEPT 83 
FMP ALEXANDRIg (196g-635) (P) 
DIRECTOR PRIORITY 
BT 
UNCLAS 


CHaNGED; ulsuB s|___] onal 
x 


ERD 5 . <= = 12 SEP 16 1983 


re ~T 


- @ i \ q ° 


a 


A) ee : 
(iN AUTHOREZED EB 


GENERQY TELEPHONE ELECTRONICS (GIZF7TELEMAIL SYSTEM; FBW, CONSPIRACY 
3 = : ° 


@0 AK) 
TITLE CHANGED TO REFLECT THE laMES OF ADDITIONAL SUBJECTS AND 


NEy aLiaSES OF OTHER SUBJECTS. 
RE gLEXaNDRIq TELETYPES TO THE DIRECTOR, auGUST 27, 1983; 
AUGUST 39, 1983; SEPTEMBER 6, 1983; aND TELCaL TO supeavisor[ | Ba 
L__} pivisios s. : ce 
IN VIEy OF THE NUIBER OF SUBYECTS AND ALIASES INVOLVED, THE FACT 
THaT THE yNSUBS ARE CONTINUALLY CREATING NEW NAMES FOR THEMSELVES 
gND THE FACT THaT gDDITIONaL SyBUJECTS aRE BEING CONTINUOUSLY 
IDENTIFIED, THE CODE NaWE “Ma IWFRaWE" 18 SUGGESTED FOR THIS CASE. il 
FOR INFORMATION, IN THIS CaSE, SUBJECTS ARE HaCKING INTO A 
“Mj INFRAME”, THAT IS 4 COMMERCIaL COMPUTER, RaTHER THaW HACKING AT 
SOFTWARE (1 «Es PaCKital GaneS) 
SEARCH OF ByREAU INDICES CONDUCTED ON SEPTEMBER 9, 1983, WAS . 
NEGATIVE FOR SUGGESTED CODE NaM& qND AUTHORITY HaS BEEN GRANTED FOR 
ITS ySE BY SUPERVISOR. _—s«diOW SEPTEMBER 9, 1983, IN RE TELCAL. ae 


BT ‘ 
™. 
ag/ 


: an % é a0 
+ Revell ~eseptehter 7, toes Le 


+ Training 
Telephona Ren. 


Director's Seec'y 


ae 


b6 2 


Sor 


\ 


+ Subject: UNSUBS: 


sy 
{aoe Wy 


oO 


a i TELEMANN. “Sys EM 
4 PURPOSE: [fo Sr asin emsteent mae A A A 
9) 
A 


To provide update information concerning this investi- 
gation of unauthorizedaccesses to theSéeneral_Telephone and : 
Electronics. Companyf (GTE) Telemail system. 


RECOMMENDATION: : oe 4 
None, for information only. 


APPROVED: Adin. Servs. Laboratory 
Crim. Inv, f Xegat Coun 


' Off, of Cong i 7 
fr Director & Public Alfs, 
; Exec. AD-Adm. Went 


— Rec. Mgnt. ai . 
v4, Exec. AD-Inv. inspection____ Tech, Servs, GAL ¢ 
a Exo. AD-LES _ fntetl. Training’ gym 
DETAILS: 


‘ 
d 


GTE owns ‘and operates a computer network known as Telenet 
which links various subscriber businesses and government agencies 
in numerous cities. Within Telenet is a service known as Telemail 


pesl9G - 17/2 - Ail 2, a 


= j@ OCT 11 1983 4 
= 4 be 
~ or commen omerirs BTC 


“sg 


ra 51/003 
5 y al 


to Mr. Revell Memorandum b6 
RE: UNSUBS; 


BIC 


which offers computerized message capability between Telemail 
customers. Recently, GTE learned that their Telemail system + , 

has been accessed by unauthorized intruders. The intruders ’ 
obtain subscriber passwords and create "bulletin boards" which 

provide access and other information to other intruders. 


a 
Currently, three lg@ésely organized groups or circles 

of intruders have been \dengfified by the Alexandria Field Office. 

The "Inner Circle” seems' consist of younger intruders some of 

whom are in the Detroit gMichigan area; the "Phalsers" seem to he 

more malicious and havg@"penetrated and eliminated some records and 

communications associated With CoCa Cola Company and Raytheon; and b6 

theL____—|group (short for ) which seems to bic 

operate out of the Oklahoma . 


ity, anoma area. 
These groups are known to have penetrated Telemail user 
companies and agencies such as IBM; NASA; Jet Propulsion Laboratory; 
Time, Incorporated; TRW; Hughes Aircaft Corp.; Northrop Corp; U.S. 
Department of Agriculture; BMW; and National Systems Management, Inc. 
Additionally, the "Phalsers" gained access to the Depar: n £ - 
fense (DOD) ARPNET system. In a message dated e/2e/83, | 
described the DOD advanced Research Projects Agency in detail includ- ,¢ 
ing its location and some of its research projects such as “nuclear bic 
monitoring research, lazer beam, and particle technology”. 
also left messages and information concerning access of ARPNET. 


In one instance in July 1983, GTE prevented from 
accessing an internal system by changing the password. 66 
responded with an irate message that she was very angry at being pre- 7c 


vented from accessing the system. She threatened that if she can 
access "SYSADM" then GTE Telenet "is finished". Access to "SYSADM" 
would allow a person to disrupt the entire Telemail system. 


Messages left on "bulletin boards" are providing information 
of lead value as Alexandria Field Office attempts to identify the 
unauthorized intruders of the GTE Telemail system. Meanwhile, trap 
and trace procedures are being instituted in Baltimore, Detroit, New 
York, and San Diego which will determine the home telephone numbers 
of the intruders once the trap and trace procedures have started. 
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. SEARCHES CONDYCTED ON OCTOBER 13, 1985, 18 NEW YORK (STATE 
UNIVERSITY OF WEy YORK..qT STOWEYBROOK aND PORT JEFFERSON) AND’ 
Sal’ DIEGO ALSO RECOVERED PERSONAL COMPYTERS IN EVIDENCE OF 
HACKING « , SO 

‘NO OTHER SEARCHES qRE qNTICIP TED I THE IMME DLATE FUTURE 
IN, THIS Ma TTER. : , 

FOR INFORMATION OF WEy YORK, “ALEXANDRE a 1S CONTINUING 
ATTEMPTS 70 IDEWTIFY yNSUBy axas[ i WHO. 1S a MAJOR 
HaCKER THOUGHT TO.BE IN THE NEW YORK AREA. WEW YORK IS THEREFORE 
REQUESTED TO EXPEDITE TRANSFER OF EVIDENCE FROM SEARCH OF be 
wUSB RADIO ST gT ION aND -RESIDENCE- aT v7e 
SINCE THaT SUBJECT IS qN gSSOCIaTE oF Jain. UT,EXPECTED THAT 
A TRUE NaNE qND PHONE NUMBER OR ADDRESS yILL BE IN SEIZED PAPERS. 
‘FOR, INFORMgTION OF gLL OFFICES, REQUESTS BY ALEXANDRIA IN 
REFERENCED TELETYPES TO TRANSFER aL HaRDy ARE, EIC., TO USA's 
OFFICE, 70) PRINCE STREET, ALEXANDRIa, VIAGINIA 22314, ATTENTION: 
“usa, SHOULD HaVE CONTINUED THaT ALEXANDRIA CASE - Pe 
AGENT yILL-qCTUALLY RECEIVE THE EVIDEWCE aT THaT OFFICE To 
ENSURE aPPROPRIQTE CHaIN OF CUSTODY IS REFLECTED OW ENCLOSED FD-192"S, 
BI ; 
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A, 
1983 AND ocTOBER Lay me 


AS THE BuREAU Is AWARE, EXTENSIVE NED IA ak SEB 
ATTRACTED TO THIS CASE AN SEVERAL INQUIRES HAVE BEEN RECE Wep 
CONCERNING THE POSSIBILITY OF INTRUSION INTO DOD COMPUTER SYSTEMS. 

THIS PRESS INTEREST APPAREMILY STEMS FROM STATEWENTS BY FayTLY 
MEMBERS OF & RESIDENCE. SEARCHED IN DETROY Pep Putin is = 


FOR INFORMATION, INVESTIGATION IN Tus se HAS At REVEALED 


ANY KNOWN PENETRATION OF DOD COMPUTER SYSTEMS. TNTR WER S IN THEE 
PEEENA I OOMPLUTER DID PASS ON THE. FACT THAT, IN THE RECENT PAST 7? ocr TS 83 
A few SYSTEM, MIL NET 
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| 


WAS SPL iiffeney OUT oF ARPANET. -GTE aes 


ss was PUBL IC: SO.UR CE INFORMAT-10 8 AND wr) 


PERSONNEL IND ICATED 
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NEED NOT BE DERIVED FROM ELECTRONIC: INTER CEPT ION. 
ALT HOUGH. NOT WITHIN THE SCOPE OF THIS IWEST IGATION, -IT 
APPEARS THAT ARPA NET IS A COMPUTER NETWOR K SYSTEM SET UP 
TO PROV IDE | COMMUN ICAT 10 NS§ETWEE N UNIVER SIT IES COMUCTING RESEARCH 
EXACG FUNCTION OF MILNET IS UNKHOW N TO THIS OFFICE , , 


BT 


Lent, 


647 (1-158 1) $ CRIMINAL “eo DIVISION 


INFORMATIVE NOTE . 
Date. 9/30/83 


MAINFRAME ; 
Re: FBW; CONSPIRACY; 
00: ALEXANDRIA 


By attached teletype, Alexandria advises that 
investigation into this matter (previously cap- 
tioned "insubs,"[ Et Al; unauthorized 
entry into GTE Telemai ystem") has revealed 
that unauthorized intruders into the GTE Tele- 
mail System in eight cities throughout the 
U.S. have been identified. Alexandria is now 
drafting affidavits for search warrants and it 
is anticipated that_by 10/3/83 those affidavits 
will be facsimiled to the eight field offices 
for presentation to local Federal Magistrates. 
When the desired search warrants have been 
authorized, they will be simultaneously executed 
so as to prevent subjects from notifying each 
other resulting in the possible destruction 
of evidence. 
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MAINFRAMES FRAUD BY WIRE$ CONSPIRACY (0 :AX) 
RE ALEXANDRIA TELETYPE TO DIRECTOR, SEPTEMBER ‘Oy 1983. 
FOR INFORMATION OF THE BUREAU AND ALL RECEIVING OFFICES, 
IwesticatioN” WAS REVEALED THE on, Be INCOMING #AYA.S To GTE'S 
rt Renee : i : : 
vs atoot & 183 
: ee: 
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TELEMAIL SYSTEM IN EIGHT DIFFERENT CITIES. ALEXANDRIA | a 

IS WORKING WITH auSa[____—=—=sd& EDVA, TO DRAFT. AFFIDAVITS FOR 

SEARCH WARRANTS TO BE EXECUTED IN THESE EIGHT CITIES. 

ALEXANDRIA ANTICIPATES THAT ALL AFFIDAVITS WILL BE DRAFTED ‘BY 

OCTOBER 3, 1983, AND THEY WILL BE FACSIMILED TO THE APPROPRIATE FIELD be 
OFFICE FOR PRESENTATION TO THE LOCAL AUSA FOR REVIEW AND PROMPT pre 
PRESENTATION TO A FEDERAL MAGISTRATE. ALEXANDRIA WILL REQUEST THAT 
ALL OFFICES NOTIFY ALEXANDRIA“ (Sal BY, TELCALL WHEN WARRANT 
IS SIGNED SO’THAT ALEXANDRIA MAY COORDINATE THE SIMULTANEOUS 
EXECUTION OF THE SEARCHES IN ALL CITIES. THIS IS NECESSARY TO 
PREVENT SUBJECTS FROM NOTIFYING OTHER SUBJECTS OF THE ONGOING 
SEARCHES, RESULTING IN THE POSSIBLE DESTRUCTION OF EVIDENCE. AT 
THIS TIME, PROBABLE CAUSE IS AVAILABLE AND AFFIDAVITS ARE BEING 


DRAFTED FOR THE FOLLOWING LOCATIONS: 


|. ‘le ALBANY Diviston aitHtcay,—>—Ss—~<CS~CS~S~SCCS 
(2. BUFFALO DIVISION (ROCHESTER), RESIDENCE oFL_ 
3. DETROIT DIVISION, RESIDENCE OFL_—SSC—C~CSCSCSCSCSCS 


+ PAGE THREE ax 196433 uncLas — 6 
CT bs 
, - BIC 
Se OKLAHOMA CITY, RESIDENCE OFLSCS@Y 
6. omawa, Restpence of[__ 
. b6é 
7, PHOENIX, RESIDENGE OF[ ae 
ee 


es 


FOR INFORMATION OF NEW YORK, INVESTIGATION TO DATE INDICATES A 
strong posstaatity tat} ace[ dre 
. b7c 
CF} tet ervone wuneer———} 1s 


|. [a mauoR HACKER IN TELEMAIL. FURTHER, TRAP AND TRACE BY 
a 
2 
; bIE 
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() tenerione sumer ———=d#dsAND ALSO 
TELEPHONE NUMBER[ __—=———=sdp. CUSTOMER WAME AND ADDRESS INFORMATION 
* UNCLEAR. ; - 
“LEADS +: NEW YORK. aT NEW YORK: 1.) WILL DETERMINE IF THERE 18 
ANOTHER TELEPHONE LINE LISTED 10 ive ——sSsS—S—SSSOSOSOSOSCSCSCSCSY 
-[___} aDDRESS AS HACKERS ALSO HAVE a SEPARATE-LINE FOR THE 
“COMPUTER. 2.) WILL OBTAIN SUBSCRIBER IWFORMATION ON TELEPHONE 
“wumBer 3.) WILL OBTAIN FRoML_SS—sd 
[- __leurrent INFORMATION’ AVAILABLE FROM. TRAP AND TRACES, 
SPECIFICALLY NOTING TELEPHONE NUMBERS[ OS 
CO 
CC 
| 


OMAHA AT COUNCIL BLUFFS, IOWA: WILL OBTAIN SPECIFIC ADDRESS 


AND DESCRIPTION OF RESIDENTS OF[S=«&@SSCTELEPHOWE 
wumBer[«diCCoOMPUTER PHowE> awp[_——s—=idSC«CPLLEEASE 


REPLY BY TELEPHONE CALL TO ALEXANDRIA - sal _}D 
PHOENIX AT TUCSON, ARIZONA: WILL OBTAIN ALL IDENTIFYING 


“pé 


bic 
BIE 
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BIC 


woe gd os c on . see te 


SPECIFICALLY, BOES A 17 OR 18 YEAR OLD MALE’LIVE AT THAT ADDRESS 


AND ARE.BOTH PHOWE NUMBERS LISTED TOL ——S—S—S—™—~—S MPLA 


REPLY BY TELEPHONE CALL TO ALEXANDRIA - Sal) 
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BUFFALO AT ROCHESTER, NEW YORK: SINCE MESSAGES: RECORDED: FROM 


[ Jto[inpicate THE PosSIBILITY.OF Two COMPUTER 


ROCHESTER WILL PROVIDE DESCRIPTION OF RESIDENCE, SPECIFICALLY 
LOOKING FOR AN ATTACHED BUILDING SERVING AS AN OFFICE (FOR.EXAMPLE, 
A CONVERTED GARAGE OR ADDITION TO THE HOUSE). - (PLEASE REPLY BY 
TELEPHONE CALL TO ALEXANDRIA ~ Sal) 
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RE ALEXANDRIg TELETYPE TO DIRECTOR, SEPTEMBER 29, 1983. b7C 
FOR INFORMATION OF BUREAU AND ALL RECEIVING OFFICES, . , 
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mY 9b WMS 


B ; : 
a OCT 19 1983 - \ 
ee ee 


FF Vv 
5 Cugy25 1993 


“ : @ @ 


PAGE TyO aX 496,-633 UNCLAS 


OF SEARCH waRRaNiS 10 BE EXECUTED aT THE FOLLOyING LOCATIONS: 
1.) qlBauy pivistow - gisany,——CSSCSCSCSCSCSCS a 
- . bIC 
ALBANY DIVISION - ITHaCa, | 
a = a . 
2.) ByFFaLO DIVISION - Rochester, [ b6 
. b7c 
[ esabewce of [dp 
—£ Cn ES 
3.) DETROIT DIVISION - DETROIT,[———~—SSSCid'C 
[_}soresivewce of) axa _} - 
4.) LOS gNGELES DIVISION - BEVERLY aiis,[_ Pe 
C4 : | 
LOS aueLgs -savine,[ —SSSs—S—SCSCSSCS J 
pesIpEwCE oF[__} aka[___} (TELEPHONE SUBSCRIBER is 
Co Bre 
iOS gNGELES -arving,[———S—=~—SSSSCC~C*idYSCREST DEEN 


Vv 


PAGE. THREE ax seat ats - e 
orf ™~*~—“—tSCSUBYECT USES gilas——i+tgK 
LOS gNGELES > Inviwe, [VV 
AESIDENCE or[ Jaio- —S—S—~—CS Fs Suc uses alies( COC 
5.) DETROIT DIVISION - scarsDate,[ ssid Mie 
L.—si*@dSSeestvence or[SCSCSC*@SCKAA 
ae | 
; 6.) OKLAMOMg CITY Division - Normav,[ —S—S—S— 
eas & ; be 
7.) OMaHa DIVISION - COUNCIL BLUFFS, IOwa,. ————idi o< 


C7 exalt 
8.) PHOENIX DIVISION - Tycsow,—>O™~—OOCCC‘idCdS 
[___] REISDEWCE ofl}. swukct uses atiasl___] 

FOR INFORMATION OF Sg DIEGO, ADDITIONAL INVESTIGATION HaS bre - 
INDICATED THE POSSIBILITY THaT THE PHONE AutBER[T ___} 
MgY NOT BE THE RESIDENCE oF[ |ansur, axaL ——SS——=*dS; 


THEREFORE WO SEARCH yILL BE EXECUTED aT THIS TIME. 
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FOR ali OFFICES, sont SUBJECTS HaVE STATED IN MESSAGES THAT 
THEY HAVE "SELF ~DESTRUCT MECHANISMS" SET UP ON METAL BOXES : 
CONTAINING MaGWET IC Tepes, DISCS, ETC., THAT WILL REMOVE ALL 
INFORMaTION IF, THE BOX 1S OPENED IMPROPERLY. IN PARTICULAR, 
sussect. SOB INL SSSC=«&dS:CgS): STATED THQ TOO 

" PROPERLY OPEN THE METaL BOX CONTAIWING HIS TAPES, ONE MuST PLACE 
A WaGNET ON THE UPPER LEFT CORNER OF THE LID WHILE OPEWING. 

ALL SudJuECTS ROYTINELY USE STOLEN LONG DISTANCE SPRINT, MCI 
OR METROFONE ,CCESS CODES aND MOST HaVE “BLUE BOXES, BLACK BOXES 
oR SILVER BOXES" TO ILLEGALLY aCCESS LONG DISTANCE LINES. 
HOWEVER, THESE “BOXES” NaY NOT BE BOXES aT aLL. THE MORE MODERN 
ONES. aRE gCTUALLY COMPUTER TgPES THaT PROGRAM THE HOME COMPUTER 
TO aCCESS THE LONG DISTANCE LINES. THESE TaPES MAY BE LABELED 
“TSPS". 

FINQLLY, ALL SUBJECTS HaVE NOTEBOOKS, FILES, ETC., LISTING 
ALIASES, TRUE NAMES iD HOME PHONE NUMBERS FOR OTHER’ SUB JECTS 
THAT yOULD BE CRUCIAL FOR THE IDENTIF ICaTION OF aDDITIONAL 
UNSUSS I THIS MaTTER. . / : 

FOR INFORMATION, SaC, @LEXANDRIg, 1S NOT MgxING PRESS 
RELEASE IN THIS MaTTER, aND SINCE SOME SUBJECTS ,RE JUVENILES, 


REQUESTS THAT RECEIVING OFFICES COMPLY, 


b6 
b7c 
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LEADS FOR aLb OFFICES: 

i.) SINCE IT IS \NOwil THaT MghY OF ‘THESE SUBJECTS ARE IN 
FREQUENT TELEPHOE VOICE CONTgCT WITH EqCH OTHER, IT 1S IMPORTANT 
THaT ALL SEQRCHES TaKE PLaCE aT TKE Sane TIME TO PREVENT SUBJECTS 
FROM yARWING EqCK OTHER, THEREFORE LL SEqRCHES SHOULD BEGIN aT- 
9200 EASTERN TIME (6208 ail PACIFIC) ON WEDNESDAY, OCTOBER Iz, 
933. 

Qe) EACH aGENT RESPONSIBLE FOR a SEARCH iS REQUESTED To 


CALL ALEXNDRIa (Sal —=S—S—S—S—SCS*i@S«CY TUESDAY, OCTOBER 11, (933, 


TO OBTgIN qNY aDDITIONgL DETAILS OR SPECIgL CIRCUMSTANCES St sare 
CONCERNING THE RESIDENTS TO BE SEaRCHED (aLEXANDRIq FITS 967-1200). BIC 
3.) SHOULD LOCAL auSq’S HaVE WY QUESTIONS REGaRDING .THE 
WARRANTS, THEY SHOyLD coNTacT ausaL——Ss ED Vas FITS 

557-9180. ; 

4.) EACH AGENT SyEqRING TO aFFiDAVITS SHOULD REQUEST THaT 
THEIR MaGISTRATE’ SEL THE qFFIDaVIT TO PROTECT INFORMANT =~ 
INFORMATION gND/OR TECHNIQUES USED IN THE INVESTIGATION. 

5.) “SEIZED PROPERTY SHOULD BE HaNDLED'’aS FOLLOWS: 4.) COPIES 
OF gLL NOTES, FILES, ETC., SHOULD BE FORyARDED TO ‘THE ALEXANDRIA 
OFFICE 4S SOON aS POSSIBLE FOR REVIEW FOR LE,D INFORNATION. 
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B.) qLL HaRDWaRE, COMPUTERS, TaPES, DISCS, ORIGINAL NOTES, ETC., 

SHOYLD BE PROTECTIVELY PaCKAGED aND SHIPPED To THE U.S. aTTORNEY, 

GVA, 71 PRINCE STREET, ALEX_NDRIg, VIRGINIg 22514, ATTENTION | 

auSa. SdH Ma TERIgh SHOULD NOT BE SUBJECTED To ore 
X-RAYS, MgCHETS, OR EXTREME HEAT OK COLD DURING SHIPPING ‘AS THIS 

COYLD. CAUSE 4 LOSS OF DaTa ON THE TaPES, DISCS, ETC. C.) BEFORE 

aND AFTER PHOTOGRAPHS GF COMPUTER SET-uPS, MODEWS, ETC., ARE 

REQUESTED. 
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BOST ON ROUT twe / 
CHICAGO ROUT INE 
COL UMBUS R OUT INE 
DENVER ROUT INE 
HOUST ON ROUT ne 
Los ANGELES OUT INE. 
NEW YOR K ROUT INE 
Bt 
‘pas AS 
IN FRAME; /FBW; CONSPIRACY; (00 sAX) 


“RE ALEXANDRIA TELET YPE To DIRECTOR, OCTOBER 6, 1983, AND b6 
(eK V3.2 ; BIC 


OCTOBER 13, 1983, 

FOR INFOR MAT TON oF BOSTON, CHICAGO, CG. UMBUS 5 DENVER, AND 
HOUSTON, ON OCT OBER 12 AND 13, 1983, A TOTAL OF 15 SEARCHES WERE 
EXE CUT ED LN NINE crt IES IN CAPT 10ND MATTER. SEAR CHED WERE FOR 


_ Oa ey 
/7 4") WD i, NOV.18 1983 


Ses eee 
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COMPUC ER § ANO COMPUTER -RELATED PARAPHERNALIA’ USED TO ILLEGALLY 
ACCESS GTE’ S ELECTRONIC MESSAGE DELIVERY SYSTEM CALLED TELEMAIL. 
ALL INTRWERS INTO THE SYSTEM USM ALIASES, EVIDENCE’ OBTAINED 
IN SEARCHES REVEAL PHONE NUMBERS AND ADDRESSES FOR’ ADDITIONAL’ 
UNSUBS, ; ‘ 


“FOR INFORMATION OF cHIcaso, unsuBl Janu, Akard 
[) aKas [___} WAS ALLEGEDLY ARRESTED LOCALLY IN 


CHICAGO DIR ING THE LAST YEAR FO? TELEPHONE FRAUD, INCLUD ING 
BLEGAL USE OF PAY PHONES AND OBTAINING ADD IT IONAL TELEPHONE: a 


‘LINES WITHOUT PAYING, THE TELEPHOWE aumBeR[ IS. 
ASSOCIATED WITHTHE name. asp ]a.mu>. 


ALL OFFICES ARE REQUESTED TQ PROVIDE CUSTOMER. NAME. AND 


be 
b7c 


‘ADDRESS ON PHONE NUNERS OR. POST OFFICE BOX NUMBERS PROVIDED AND 

ANY AND ALL ADDITIONAL IDENTIFIERS AVAILABLE, . 
LEADS: BOSTON, AT BOSTON, MASSACHUSETTS, WILL ‘OBTAIN 

GUST OMER NAME AND ADDRESS ON TELEPHONE womeen[ 
CHICAGO, AT CHICAGO, WLINOIS, 1) WILL, OBTAIN CUSTOMER’ © : 

NAME AND ADDRESS ON 1 ELEP HONE wuMBER[_ OB) WELL 

CONTACT LOCAL TELEPHONE COMPANY SECURITY OFFICER FOR ANY — 


INFORMATION ON CHARGES aGaINST[_ JNU, akas[— sid 


b6é 
b7c 


aos tidy ss 
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aca:[_—SS—=*&@SCPOSSUBLYY IWVGL WING ADDITIONAL TELEPHONE LINES a 
AT THE SANE ADDRESS AS TELEPHONE wel ae 
COLUMBUS, AT. COLUMBUS, OHIO. WILL OBTAIN CUSTOMER NAME AND bic 
ADDRESS FR TELEPHONE NuMBERS[ CY 
Lt , 
DENVER, AT DENVER COLORADO, - WILL OBTAIN CUSTMER..NANE AND 


ADDRESS FOR TELEPHONE wuMBER[SSSCSCSCSC~*SS 
WILL ALSO OBTAIN ALL IDENTIFIERS’ | be 
LSS HES: BOX NUMBER IS SUBSCRIBED -TO BY . e7e 
[ids swckK ts aN atas, fo 


HOUST ON, AT HOUSTON, TEXAS, ~ WILL OBTAIN CUSTOMER. NAME. AND’ 


ADDRESS FOR TELEPHONE NUMBER. 


LOS ANGELES, AT LOS ANGELES, CALIFORNIA. , WILL OBTAIN ee 
CUSTOMER .NANE AND ADDRESS FOR TELEPHONE NuMBER[ AND 


NEW YORK, AT NEW YORK, NEW YORK, WILL OBTAIN CUSTOMER. NAME 
AND ADDRESS FOR THE FOLLOWING NUMBERSs[ 
oe bé 
Be 


Br: 
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APT ®:  systEws DEVELOPME MT SECTION, 


AINFRAMES FRAUD BY WIRE 3 CONSPIRACY (OO%AX) 


a 


RE ALEXA IDR IA TELETYPE TO DIRECTOR, OCTOBER 13, 19 


}CTOBER 14, 1983. 
| AS A RESILT OF THE 15 SEARCHES: NUCTED IN THIS MATTER, 
. APPROXIMATELY 16 PERSONAL ras send A sLATED, PARDUARE ery 
H 


BEEN SEIZED.- THIS HARDWARE Is. BEIN feren Fo ke XAWOR TA FOR . 3] 


gj 
ANALYSIS FOR PROSE CUTIVE “OD NSIDER AT 10 Ne 
2 NOV 9 1983 
INIT Ta INFORMAT IO'N RECEIVED FROM FIELD OFFICES INVOLVED’ 
ees ee 


INDICATES A VARIETY OF MOME COMPUTERS TO INQLUDE IRS-80, APPLE ILE, 
ATARI AND PERHAPS OTHER. AW ESTIMATED 200 - 300 FLOPPY DISCS WERE 


ALSO SEIZED (BRANDS ma AD WO Mpc a) 


5S 


7 : . bé 
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ANAL YSIS OF THIS EVIDENCE WILL REQUIRE A PERSON FAMILIAR WITH 
THE VARIOUS TYPES OF EQUIPMENT AND ‘ABLE TO RETRIEVE INFORMATION FROM 
THE DISCS, OBTAIN A PRINT-OUT AND ALSO. INTERPRET ANY CODED OR 
PROGRAMMED MATERIAL PRESENT. 

TE IS ESTIMATED THAT A MINIMUM OF TWO TO THREE. WEEKS FULL- TINE 
AVAL YSIS WILL BE REQUIRED, WITH THE WORK TO BE DONE AT THE UNITED 
STATES ATTORNEY'S OFFICE, ALEXANDRIA, VIRGINIA. ra Bef 

ausal____} EDVA, IS THE ATTORNEY HANDLING THIS CASE. 
HE HAS WORKED IW A STwAR MATTER vitk} PHD, AND 
[| statep[_]WOuD BE AVAILABLE AS A CIVILIAN CONSULTANT AND 
“ABLE TO PERFORM THE ABOVE MENTIONED ANALYSES, WITH COMPENSATION aT 
THE PREVAILING HOURLY RATE. 

REQUEST OF THE BUREAU: 

te) WILL INFORM ALEXANDRIA WHETHER BUREAU EXPERTS ARE AVAIL ABLE 
TO PROVIDE ANALYSIS AS DESCRIBED ‘ABOVE. 7 

2.) IF NOT, WILL INFORM. ALEXANDRIA IF APPROVAL IS GRANTED TO 


OBTAIN THE SERVICES orL__]to PER FORM. ANALYSES. 
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1. ENCLOSED PHOTOGRAPHIC WORK RELATES To: 
ORCurrent investigation. 0. Mug Shot ;.. 1 Other. 
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FBIHQ USE ONLY 
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-Film To Bé ‘Processed “Movle Fiim 6r Microfilin *’ Negatives To Be Printed Other 
Size [Color] B&W] Quantity ‘Size_| Color [B&W | Quantity’ " _ [ Size [Color Baw [’Quantity’] [Item Quantity 
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: ae [110 
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Prints To Be Made. 
rom 136, 126, and 110) 
OR Siex5 0 5x7: 


,Processing 
O Process ‘only ° 

CixProcess , & make print, . igsbs 
O Process & make contact.print _ +. 


Slides to be processed 1 Color O Baw 
O Slides to-be duplicated (From 120 and 4x5) 
O 8x10 


2) 4x8 


a 
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O Coto? = -“C) Baw’ 


WAILED 11 


G Shipping Room: Show shipment date: bill of lading 
number, initial invoice; invoic tébe-placed in 


oe SUB 


MAIL ROOM p% 


3H, prints from each frame 


aa ‘prints from eat ch fare 


Prints.To Be Made | - 
(Prints trom slides) 

avi: OL BY%xB yy commny 
4 D5x7> 


O 8x10 


Custom Prints. 
{From any size negative or slide) 


Beto pte 


O Color 


C] Baw 


py, 


cate 


_ any roll film. 


Lt o¢ Yb ry, POT 


nei 


INSTRUCTIONS 


yi ilesnumber when available. All other photographic processing forms (including FD-482) are 
éte an Should not be ts tpyThe FD- $23 is to be utilized for all photographic processing work forwarded to FBIHQ 
Requests for official FBI identification’ and credential cards must be 


*infortfation is set forth to assistiin properly ‘filing out this form. Remove third sheet only (yellow field copy) and submit the 
remaining five pages. 


‘film, ‘alongside the size of the 
ssettes in the quantity column. . Slides-refer to EXTACHROME 


he a OL LT 


FILM, 
Negatives To Be Printed - Check appropriate block for size; Color or Black and White and quantity submitted. 
“Tt 136rint negatives’ are to be printed, indicate by frame number, do not cut up into. individual frames. The same applies to 


Other - Enclosures to be copied e.g. photogiaohs, doc Ir 


3. WORK’ REQUESTED: 


available ‘from our machine printers: ‘Sheek ‘Golét of Black and White: < . 
From 120 and 4x6 Film - Check size 4x5 or 8x10 and indicate Color or Black and White. These are the only 
size prints “available from our machine. printers. 


Machine prints can be made in sizes-32x5; 5x7 and: 8x10." > ~*"> 
or slide; indicate quantity and_size of prints either Color or-Black and” 
‘Custom prints aré available in variotis sizes but require extensive special. ndling: ~ This type" of Printing is ist donero on 
special request and proper justification’ must be furnished under item #4 (Ré — 


4, REMARKS: 


pagient Justification for custom prints: Any ‘Special instruction or short di » 
item #1_of this form. . 7. . . 1 


: No Personal Work should be submitted for processing. “Any requests which may be mis! fiterproied as 
Personal In nature should be explained and approval granted by the Special Agent i in Charge or hisfher rent. 


a 


Eyck! 


it? 


Director, FBI ; 
(Attn: Photographic Processing Unit, ‘Rm. 18903) 
> ~ : a 


To: 


SAC,’ OMAHA (196A~+922) 


fase * | FBIHQ USE: Y , : 
nitials 
cubic HAIN FRAME" fo |Reeeved Pda / 
. . FBW; CONSPIRACY | te Pinte f oe 
:° AT rinte se as 
4 OO: | ALEXANDRIA Enlargements “oa 13-85 26 ) 
= : Slides & po 
2 Ss * ‘| Copied 
4. ENCLOSED PHDTOGRAPHIC WORK RELATES TO: Other : 
ip:4 Currefi, inves tigation CG Mug Shot O Other . . : . 
; =~ a np Lill FAL Bow) 
Film To Be Processed : Movie Film or Microfilm. Negatives To Be Printed Other ~*~ 
. [ Size [Color Bayy| Quantity Size || Color [Baw Quantity! -| Size -| Color|-B&W.| Quantity -|. item.” Quantity 
axs[ | - | Se [46mm |.“ | {axio[ - : : : 
135| x 1 35mm * ] 4x6 
126 . Bisuper)| . +35 
120 7Omm 120 
Siiges| ANU: 126" 
“[220 
110° 


3. WORK REQUESTED 


_ Prints To Be Made 


Processing 
‘O Process only (From 435, 126, and 110) 
(% Process & make print” Bl. Biexs O 5x7 
C Process & make contact print | _>_2_ # prints from each frame 
C1 Slides to be processed JD Color. O -Baw . 
“C] Slides to be duplicated (From 120 and 4x5) 
B 4x8", 5)" 8x10" : 
Oo 4] ‘prints from each frame 
: DO Colr,. O Baw” 
4. REMARKS 


{include triat date or other 
mandatory deadline and any 


other specific instructions) pone 
ate 


ve 


f> ENCLOSURE: . 


FBIHQ Enclosure. 


Prints To Ba:‘Made © 
(Prints from slides) 


Custom Prints 
(From any size negative. or slide) 


“oO 3%xs Quantity 
OC) 8x7, Size . 
“O 8x10 C1 Color Cy Baw..." 


Film rac’d & sete with, 
to. - 
vInitidate 


* NOT R CORDED 
41988, 5 CoP STIS 


somata 
aS A AL. = 
JSS ABR wl 


sxooss (382.82 457 ae 
jE a x 


RR ‘ye 
DE.AX 
P G28 2860Z20CT. BY 


FM ALEXANDRIA VI96A-635) CP) 


TO DIRECTOR RGUT INE 


FBU 3 CONSPIRACY: (00:AX) 
RE ALEXANDRIA TELETYPE 10 DIRECTOR, OCTOBER 18, 1983. 
FOR INFORMAT 10W OF THE BUREAU, sa ]cav xan TA) HAS 


COM ACTED TWO DIFFERENT FIRMS IN ORDER TO GET ESTIMATES: ON: THE. 


COST OF RETRIEVING INFORMATION FROM FLOPPY: D 1SKs RETR IEVED” a : Peo 


searcres. [Jas OFFERED TO’ PER FORM SERVICES a 


OF $75 PER HOUR. HE STATED, HOWEVER, THAT HE WOULD ‘on 8 


AVAILABLE AT MIGHTS AM ON WEE KE ADS TO PERFORM THIS TASK. 

st[______] HAS ALSO CONTACTED MICRO RESEARCH, INC., AND THAT 
we a : . b6 
FIRM HAS OFFERED THE SERVICES OF ONE OF IS TECHNICIANS aT, THE "Bre 


RATE OF $45 PER: HOUR’, moe ad ‘aus 
“INC, ALSO INDICATED THAT WE ObusD ‘rR VIDE HIS TECHNICIAN ON 


“AN AS- NEED’ B. . 
A ASIS.TO DO THE WORK aT THE U.S -ATTOR NEY" s orig al 10 1983 


ays gE Cid ADDENDUM BG. 3 


PAGE Tw AX. 1964-633 UNCLAS : 
ALEKANDR IA, EL IMINAT ING ANY. DIFFICULTIES CONCERNING CHAIN OF 
cust op Y OF THE EVIDENCE. ~ 

: ALEXANDRIA 18° STILL ‘Est TWAT ING THO TO THREE WOR K WEEKS TIME 
E CESSARY TO OBTAIN THE NECESSARY INFORMATION. AT THE RATE OF 


. $45 PER HOUR, THIS WOULD EQUATE’ TO $360 PER DAY, OR FOR THREE’ 

3 PULL WEE KS WORK. THIS WOWD COME TO APPROX IMATELY $5, 400. THERE 
WILL BE SOME INCIDENTAL EXPENSES, .FOR CEA EES PoncHastne, OF 
‘CORUTER PRINTOUT PAPER, ETC. ‘ ; 

AS ALEXA NDR TA -HAS ALREADY RECEIVED APPROXIMATELY 3 BOXES OF 
EVIDENCE FROM OTHER OFFICES, IT IS REQUESTED. THAT THE BUREAU 
GIVE VERBAL AUT HOR IZATION FOR MICRO RESEARCH, TO BEGIN THE 


ANALYSIS ON MOWWAY, OCTOBER 31,1988. SSSSs—~—CS—SsS 


WICRO RESEARCH, Iie, IS FORWARDING A WRITTEN STATEMENT TO, THE 
| ALEXA NDR TA OFFICE INDICATING THAT HE WILL PROVIDE, ONE TECHNICIAN 
OW AM HOURLY Basis AT. THE RATE -OF $45 PER HOUR TO. PER FORM THE 
NECESSARY TASKS. “ToT AL EXPEND IT URE WILL. -NOT EXCEED Jao. Wi 
ACCORDANCE WITH OONTRACT REV IE Mw UNIT, @ BID aM CO NERA CE 

PROCEDURE IS THEREFORE NOT REQUIRED. : 
nt 


be 
b7c 


b7E 


Teletype from Alexandria (196A-633) 
Dated 10-29-83 , 
RE: MAIN FRAME 


ADDENDUM: CRIMINAL INVESTIGATIVE DIVISION (CID) K md 11/1/83 


The Financial Crimes Unit, White Collar Crimes Section, 
has reviewed the request of the_SAC, AX that authority be granted 
to expend funds not to exceed sL___ from the Field Support b7E 
Account. These funds will be utilized to pay for a private con- 
sultant to review 200 - 300 floppy discs which were seized during 
the execution of numerous search warrants in various areas of the 
United States. Examination of the discs is necessary for evident- 
iary purposes. 


Analysis of these discs requires a person familiar with 
the various types of computer equipment who.can retrieve information 
found on the discs, obtain print-outs, and intrepret any coded or 
programmed material on the discs. The Technical Services Division 
(TSD) advises they only have one employee with sufficient expertise 
and because of scheduling conflicts, he would be unable to devote 
two to three weeks full time to the task. The Contract Review Unit 
dvi no contract need be negotiated if total fees are less than 
3 bTE 


AX has solicited informal estimates from two qualified 
area consultants. The lowest estimate which also takes into consid- 
eration chain of custody of the evidence was for $45/hour. It is 


estimated the computer technician will require two to three weeks 

re to complete this task. (Tt 78 

show e note a is consultant: group, Micro Research, Inc., 

was recommended by TSD who has utilized their services in the past). 
The Financial Crimes Unit, White Collar Crimes Section, 


recommends that AX be given authority to expend necessary funds, not 
to exceed $ in order to have the necessary analysis conducted. b7s 


ROVETR Adm. Sarve. aboratory, 
am. rv egal Coun 
Director Git. of Cony, 


A Public Alte, 
40 Exes. AD-Adm. 0 tent wee ‘sont 
Exec. AD-Inv. inspection, Tech Servs 


Exec. AD-LES intatt Training 


ye 


(3)* 


6-147 Ge13-81)" CRIMINAL INvE@pative DIVISION 


INFORMATIVE NOTE 


Date_October 14, 1983 


Re: MAINFRAME; FBW; CONSPIRACY; 00: ALEXANDRIA 


It should be noted this code named case 
refers to an AX investigation concerning unauth- 
orized access into the GTE computerized Telemail 
system. 

By attached teletype, Alexandria advises 
that on 10/12/83, 12 simultaneous search warrant 
were executed by the FBI in 10 cities throughout 
the U.S. Seized during execution of the search 
warrants were home computers, modems, and numer— 
ous documents constituting evidence of computer 
"hacking". Three more search warrants are ex~ 
pected to be executed in the near future based 
on information obtained from the first 12 search 
warrant executions. 

For background information, this case was 
initiated when GTE learned that unauthorized in- 
truders were accessing their Telemail system and 
destroying records and disrupting services. 
Three organized groups of computer "hackers" werk 
eventually identified and messages indicated 
these "hackers" had penetrated numerous company 
and agency computer systems. Further investiga-| 
tion resulted in identifying the true names and 
location of 12 of these “hackers" and thereafter 
sufficient evidence to support the search war- 
rants was collected. 


Enclosure 


xp xf (11) 


1 - Mr. Colwell 1 - 

1 - Mr. Otto L- 

1 - Mr. Young 1- be 
1 - Mr. Revell 1- bic 
1 1 


- Night Duty Des 


Feo. 


SAC, AX advises no press release is 
anticipated regarding this matter at this 
time since some of the "hackers" are 
juveniles. However, it is possible com- 
ments made by GTE could spark the interest 


of the news media. 


APPROVE; fata. Sere, 2 Lebonstory 

; Crim. We. Tegal Coun. ~ 
Director _ Off. of Cong. 
Exec. AD-Adm dont, 8 Public Afts, 
Exec. AD-Iny, inspection _ 


y Exec. ADLES —intou, Training __. 


. - xova7 28cis3s2 € 4 ; ® 


00 HQ AL BU DE LA OC 


Grim.inv. “3 
dent, 
Inepestion 


AX0607 28615332 


PP HQ AL BUDE LA NY OC OM PK SD Tos 


j ao ; 
DE AX rducray i 5 a7. ; 
081315 15Z OCT 83 : Z 


jn ALEXANDRIA C196A- 


TODIRECITQR IMMEDARE> <= = 


ALBANY ROUT INE 


Laboratory 
Legal Coun, 
Rec. Mght, 
Tech. Servs. 
Training 
Ht. of Cong. 
& Puntic Alls, 
Telephone Bra, = 


Qiractor’s Sec'y 


BUFFAL 0 ROUT INE 
DETROIT ROUT I 
LOS ANGELES adut INE 
NEW YOR K IM Lure 
OKLAHOMA wy ROUT INE 
"OMAHA R OUT/INE 

PHOENIX R/OUT INE 

SAN DIEGO IMMED ATE 


Br 


UNCLAS , / 16 -YY|3— Id 
Goan mae ro CONSPIRACYs (00 :AX) - 


RE ALEXANDRIA TELETYPE TO DIRECTOR, OCTOBER 6, 1983, 
FR INFOR MAT ION OF THE BUREAU AND ALL ‘RECEIVING OFEASES 9 ON 
OCTOBER 12, 1983, BUREAU, AGENTS EXECUTED SEARCH WARRANTSEINGT 


PAGE TWO AX 196A-633 UNAS 
FOLLOWING CITIES: ALBANY, ITHACA, ROCHESTER , AND, SCARSDALE, 

NEW YORK; DETROIT, MICHIGAN; OMAHA, NEBRASKA; NORMAN, 

OKLAHOMA; TUCSON, ARIZONA; BEVERLY HILLS, CALIFORNIA,.AND IRVINE, 
CAL IFOR NIA (THREE), ALL SEARCHES RECOVERED HOME COMPUTERS, 
MODEMS, AND EVIDENCE OF “HACKING.” 

REFERENCED TELETYPE NOTES THAT SAC, ‘ALEXANDRIA, IS NOT 

MAKING A PRESS RELEASE SINCE SOME SUBJECTS ARE JUVENILES, 
REFERENCED THLET YPE SHOULD HAVE, CONTINUED THAT USA, EDVA, Is 
HAVING D IFFICULTY ESTABLISHING PROSECUTIVE INTEREST IN CHARGING 
JUVENILES, CONSEQUENTLY, LITTLE PUPOSE WOULD BE SERVED IN_ 
HIGH. IGHT ING JUVENILE, PARTICIPATION IN THIS CASE AT THIS. TIME 
AND COLD PLACE US IN THE UNNECESSARY. POSITION OF HIGHLIGHTING 
CRUCIAL EVIDENCE WHICH WE EXPECT SEARCHES TO PRODUCE, ~~ 

FOR INFORMATION OF Sal DIEGO, DURING SEARCH wld 


[= 5} svese¢ =} mre vee re neste} 


TELEPHONE NUMBER[——S——id~SCCUSTOMER -NAME AND: ADDRESS FOR pic 


THIS PHONE NUMBER TS[_———sidAs SAME ADDRESS. THERE IS 


ALSO A SECOND LINE AT THAT ADDRESS,[_———S—=sd+isS ALEXANDRIA 


MADE A PRETEXT PHONE CALL TO THAT NUMBER AML | 


we 


— © e 

PAGE THREE AX 1964-635 UNCLAS a 

ANSWERED THE PHONES ALEXANDRIA THEREFORE TRANSMITTING AW 
" AFFADAVIT TO SUPPORT A SEARCH WARRANT TO SAN DIEGO BY FACSIMILE, 
ATTENTION: sUPERVIsR[ sid = 

FOR INFORMATION ‘OF NEW YORK, TRAP AND TRACE INFORMATION 
a 
[ftw tcar ter 
CT 
pes ALL |/|p_PPID Trap an tkace was aso.sHowen[___ 
CO 
T 
DT 
CL ——C—CSC*dsosFFD'AVIT FOR SEARCH WARRANT FOR BOTH 
LOCATIONS WAS FACSIMILED TO USA, EDNY, AND PRESENT® TO 
MAGISTRATE.ON OCTOBER 12, 1983, 
LEADS: SAN DIEGO, AT SAN DIEGO, CALIFORNIA, 1) WILL 

PRESENT. AFFADAVIT TO AUSA AND MAGISTRATE AND EXECUTE SEARCH 

2) EVIDENCE SHOULD BE HAMDLED AS SET” OUT IN REFERENCED 

TELETYPE. 


b6 
b7Cc 


1b6 


b7C 
b7E 


b6 
b7c 


PAGE FOUR AX 1964-635 UNCLAS ; 
NEW YORK, AT STONE YBROOK AND PORT JEFFERSON, NEWYORK. 1) 


VILL EXECUTE, seaRcM wank awt at [——_} 


AW WUSB RADIO STATION, ROOM 348, BUILDING 37, STATE UNIVERERSITY 


OF NEW YORK AT STONE YBROOK IMMEDIATELY. 2) EVIDENCE. SHOULD BE 
Ha ADL ED AS SET OUT.IN REFER ENCED “TELETYPE, 


BOTH NEW YORK AND SAN DIEGO ARE REQUESTED TO HAVE: MAGISTRATE, 


SAL AFFADAVIT TO PROTECT IDENTITY OF COOPERATING SUBJECT AND/OR 
AINVE ST IGaT IVE TECHNIQUES. 
Bt ; : 
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FBI ( ¥ 
TRANSMIT VIA: PRECEDENCE: CLAS SIFICATION: 
oe (j Teletype Immediate i 
() Facsimile Priority Ss] H 
fq) Airtel Routine oe ! 
UNCLAS EF TO H 
UNCLAS : 
I 
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Date 10/24/83 


Avo: DIRECTOR, FBI 
h. ATTN: ENGINEERING /S iON, TECHNICAL 
SERVICES DIVISION 


FROM: SAC, DETROIT (28E-847) (P) (C-6) oy 


{O00: ALEXANDRIA) 


Alexandria. 


Re Detroit airtel dated 10/19/83. 


those accounts by legitimate users. In order to obtain further 
evidence of the illegal and unauthorized access to Telemail and 
other mainframe computers a request has been made and a court 


order extension granted for a pen registers to be placed on the 
felechene Vines ain nec Th cohiplianes with 
M LOG section 10-10.3 the following information is provided: 


@- Bureav 


- Detroit 
(1 - 66-5343) 
MAH: lam 
(5) 


> 


Title changed to reflect conversion | 
to Mainframe and change of Office of Origin from Detroit to 


An_ indivi i in the[__] residence, using the 
codename is accessing the GTE pete | fe 
network, commandeering corporate accounts and denying access £o 
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bIC 
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Approved: d i ‘ransmitted Per 4 
alae 7 he . (Number) (Time) us 
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: Z . I Tech, Live, 
? Pp i Training 

‘ i Tetepheca finn, 

UNCVAS EFT 0 | eats 

Oe /- . = 

M INFRAME $./F Bus CONSPIRACY 


TO Va ROUT INE > CE { 
‘A 


IT 18 REQUESTED THAT THE FIELD SERVICE ACCOUNT «FSA, 
DETR OI, BE AUTHORIZED FOR AN ADDITIONAL qf _‘IIN 
CASE FUNDS FOR THE ABGE-CAPTICNED-NATTER, THE ORIGINAL 
{____]1w case runps was BEEN EXHAUSTED AND ADDITIONAL 


FUNDS ARE NECESSARY TO CARRY THE INVESTIGATION TO ITS 


LOGICAL AND PROSECUT IVE. CONCLUSION. THE FUNDS THUS FAR 
HAVE BEEN USED TO PURCHASE CG1PUTER RELATED EXPENSE ITEMS 
SUCH AS PAPER, RIBBONS, SMALL ELECTRONIC CQIPONENTS, AND 

A CONSIDERABLE SUM PAYING LONG DISTANCE TELEPHONE EXPENSES. 
; THE THRUST OF THE INVESTIGATION IS BEING FOCUSED ON 
LOOSELY ORGANIZED EFFORTS BY INDIVIDUALS, NATIONWIDE, TO 
GAIN ACCESS INTO GOVERNMENT AND CORPORATE COMPUTERS THROUGH 


a? a /%6 “Uy 


‘ we oe . on 
ae ‘Sad mE gy eet 
ot - . i Beeld 


Ss a ) 
a? apse WF NOV 9 1983 \ 
| S@DECy 1983 


BIE 


bTE 


we @ . 

PAGE TWODE 286-847 UNCLAS E FT 0 

VAPLOUS DATA NETWORKS, I.E. TELENET AND ARPANET.: 

INF RMATION OBTAINED BY THESE INDIVIDUALS IF SHARED BY 

POSTING MESSAGES ON UNDERGROUND COMPUTER BULLETIN: BOARD SYSTEMS 
(CBBS), THE MONITORING OF THESE CBBS HAS PROVIDED VAST 

AMOUNT SOF INTELLIGENCE AND INVESTIGATIVE INFORMATION 

WHICH LEAD TO THE IDENTIFYING OF SIX OF THE SUBJECTS IN THE 
ABOVE~CAPTIOVED INVESTIGATION; 

THE FIRST PHASE OF THIS INVESTIGATION WAS FOCUSED ON THE 
UVAUT HORIZED USERS PENETRATING THE GTE TELEMAIL COfPUTER 
SYSTEM, HOVEVER , CHER COMPUTER: SYSTENS ARE BEING COIPROISED 
BY THE SAME INDIVIDUALS AND OFHERS YET UNIDENTIFIED. . IT 
IS IMPERATIVE THAT THE. MONITORING CONTINUE, NOT ONLY TO HAVE A 
CONSTANT FLOW OF INFORMATION, BUT TO INSURE OUR CREDIBILITY AS 
A PARTICIPANT IN THE INFORMATION CHAIN IN THE UNDERGROUND 
“CRBS COIMUTTY. 

THE ADDITI OVAL FUNDS THAT ARE BEING REQUESTED WOULD BE 
USED TO COVER EXPENSES AG THEY RELATE.TO THE MONIT ING OF - 
THOSE BOARDS$ TELEPHONE BILLS, COMPUTER PAPER, PRINTER 
RIBBONS, AND RELATED EXPENSE ITEMS. ; 

Bt 
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DATE 


OCTOBER 28. 1983 


CLASSIFICATION a 


UNCLAS PRIORITY i 


——_—_| . 


SFOO?PEPP DEEDE Ha eDOO? SAQYUEP 3LL530Z OCT a3 


START HERE 


FM DIRECTOR, FBI 
[70 FBI DETROIT {SQUAD C-L} PRIORITY 
BT 


14L_ UNCLAS ‘On . 


SHAINFRANE§ Bus CONSPIRACYS 00: AX 


a 
RE DE TELETYPE DATED 10/25/83. g 
a 
APPROPRIATE AUTHORIZATION IS GRANTED FOR DE TO EXPEND Fs 
eo OB 
oh uP TO qf MORE UNDER CASE FUND AUTHORITY AS REQUESTED” IN < |b 
| ecrerenceo TELETYPE. g 
a 
sL BT § 
fe] 
LI S 
ot 
a 
aL 
DO NOT TYPE MESSAGE BELOW THIS LINE o— 
AP} VED BY DRAFTED BY DATE ROOM TELE EXT, 
Thu ee fi<o KD? SM)(e3+ [to-2a-a3 [eu 5544, 
y NY 
1 [Ve meth Bs 


L FOF 


PEDRRANFUREAU OS yee non 
VG\BI/ RF 
ETSI 1983 


DO.NOT FILE WITHOUT COMMUNICATIONS STAMP FatsDos 


oe - ‘SERVICES COMMITTEE 


HOUSE ADMINISTRATION 
SQMMITTEE, 
REPUBLICAN STUDY 
COMMITTEE 


REPUBLICAN POLICY 
COMMITTEE, 


EXECUTIVE COMMITTEE. 


NATIONAL REPUBLICAN 
‘CONGRESSIONAL COMMITTEE 


hones 1, 1983 


@ 


Congress of the United States 
House of Representatives 


ROBERT E, BADHAM 
40TH DISTRICT, CALIFORNIA 


Federal Bureau of Investigation 
Office of Congressional Affairs, Room 7240 
loth and Pennsylvania Avenues, N.W, 


Washington, D.C. 20535 


bese} 
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a WasaunaToN, D.C." 20518 


(202) z25-s01t 
DISTRICT OFFICE: 


‘Sure 240 


WASVINGTOR OFFICE: 
> eso Ravounn House OFricg Bunting 


189 Newror CentER Drive, 


NEWPORT BEACH, CALIFORNIA 92660 


714) 466-4080 


FEDERAL GOVERHREH? 


b) 
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Enclosed is a copy of a letter I have received from a number of my constituents with 


regard to the manner in which the FBI recovered computer 


fgipment which was allegedly 


used in tapping into the commercial Telemail systemrxun by’GIE. I would appreciate 


your review of and comments on the enclosed 
to my Washington office to the attention of 


REB:kd 
enclosure 


H-23-43 
ESHISts 


/%- Fil 


nn Please send your respons’ 


igfance in this matter. 


1 5t 


I DEC 15 1983 


—e 


7S 


0 renee a AAA eet tec eee 
Dear Robert Badham, 


As a resident of Irvine, I am deeply concerned with the 
tactics the FBI used in our city a few days ago. I feel 
the local newspaper :The Register" has hit the nail on 
the head. I have enclosed a copy of the article for you 
to read. The laws were not made to harass people, but 
to protect them. 


You as an elected offical are put into office by the 

people in essance you are our voice. I would like you 

to look into this incident and see what can be done 

about the FBI. Please find out why they acted in the manner 
discribed, If this 1s allowed ti pass by without an outcry 
from us, they will feel they can continue to confiscate 
anything they please in the future. I am looking foward to 
hearing from you on this matter and seeing what action you 
wi take. 


Thank you in advance for your attention in this matter. 


Chen nnnter ne 


196-UN> [BK 


ENCLOS.. ents 
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The Re 


A diviaion of Freedom Newspepers, Inc. 


pister: 


“There is no security on this 
earth; there is only . 


. rtuNity,” Ree 
OPRO ty n. Dougies MacArhus + 
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- FBI storm tactics in Irvine 


few weeks ago the Woodbridge 
Az: in Irvine was leaftetted by 
local police. Residents were 
an warned to be careful about opening the 
door to strangers. The purpose, every- 
dne thought, was a rash of rapes in the 
area. In light. of subsequebt develop- 
ments, does it almost seem like an 
~ advance warning that the FBI was plan- 
fing a dawn raid on teenage computey 
Mackers? No, it couldn’t-be. -. 
The way the FBI 


’ Soviet Union. But in Irvine’ q 

Based on information released ;to 
date, the four Irvine teen-agers were, 
among perhaps a dozen in different 
parts of the country who may have 
tapped into the commercial Telemail 
system run by GTE, using it to send 
messages without paying the fees com- 
mercial clients pay. 

If that’s the extent of their wrongdo- 
ing, some law enforcement officials 
could have talked to the boys and their 
‘ parents, explaining what they had done 
i, and informing them they would receive 
; | bills for their unauthorized use. . 

Perhaps something more serious is 
afoot. Perhaps these boys have, 
inadvertantly or not, tapped into some- 

1 thing else. Perhaps federal authorities 
is really want to get at the mysterious San 


_ who reportedly told the 


well have been the best way to do it. 
Instead, the FBI conducted a heavy- ° 

handed, heavy-footed raid at dawn- 

When one family didn’t answer (he door 


& (at 6:15 in the morning!}, an agent 
actually broke into a boy's bedroom. 
FBI agents seized computers and com- 


wor 


A.C. Hoiles, co-publisher 1935-1970 


_ what the boys did with them. If the FB! 


Diego fellow they know as, The Cracker, . q 
vine 


ee. 


| 
eo | 
R, David Threshie Jr., publisher .: . _ 
K. E. Grubbs Jr., editorial pages editor _ 
WN. Christian Anderson, editor 
‘ 
| 


C.H. Hoiles, co-publisher 1935-1979 
Harry. Hoiles, co-publisher 1975-1979 


puter equipment, much of it expensive. 
There’s doubt now about when (ifever!) 
the boys will get their equipment back. 

Were these boys running a murder 
ring or something to justify such tac. 
tics? Hardly. To date they haven't beei 
arrested or even charged with a crime, 


proper word) their equipment and : 
or may not give it back: ee may 


body who believes the United 
ought to be, a free’ country.’ 


hey can’do little to eptabliahi 


jneeded to establish that the boys had'*} 
terminals, they could have made out a =: 
sworn. statement to that effect and had ~ 
the boys and their parents sign them. . 


Furthermore, if the boys really were 
up to something devious, taking their - 
computers is a small deterrent. Access 
to computer terminals is relatively 
easy. Is the FBI prepared to confiscate 
everyone’s home computer? 

Tt is a sad day when law enforcement 
can walk into someone's home and seize 
property for an undetermined amount of 
time when a case is in its initial stages © 
and indictments may not be sought for 
months: Yet some attorneys believe that 
if no-indictment is issued, the parents || 
may have to sue the goverament to get ..; 
boys’ property back! 

The “jc, The FBI should put up or. shut. up: 
ABlther charge these boys with ‘a crime 
arid start prosecution immediately, or ~ 
give them back their property. If no 
indictment is sought, the computers 
should be accompanied with a contrite 
apology and compensatory damages. 
Those responsible for this outrage 
should be punished ‘or fired. 

Otherwise, the FBI is operating on the 
same moral I2vel as a burglar. fl . 
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b6 
EY WIRE; ITSP 
(00 :MZ) 


Re Director's letter to SAC, Alexandria, 10/27/83. no? 
dn. 


Enclosed for the Bureau are two packets containing i 
copies of evidence obtained in the "Main Frame" investigation, 


Packet number one contains copies of printed and Lo. 
hand-written f the residence 
located at 
residence o 
isL_]}years-old and quotes in Detroit. newspaper 
he claims to have penetrated Arpanet: The printed material 
in packet number one is apparently a listing of every Arpanet 
and Milnet host with the "connect address" or host number for 
each. The -hand-written material also contains host names, 
connect addresses and also includes some user names and 
passwords. There is reason to believe that this information 
was shared freely with other hackers, 
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Packet number two contains ssages 
left on telemail by hackers known as and 
Cer eregt 2h ianes has been lt 
identified as 


. True identity of 
is unknown. Information contained in packet 


number two was apparently obtained from some other sources 
{one being the Defense Data Network Newsletter) and then 
entered into telemail to be shared with other hackers. 


For information of the Bureau, all offices 
conducting searches in the Main Frame case (Albany, 
Buffalo, Detroit, Los Angeles, New York, Oklahoma City, 
Omaha, Phoenix.and San Diego) were requested to forward 
all evidence to Alexandria for analysis, therefore this 


response may constitute completion of lead in referenced 
letter for those offices. 
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{FLOPPY DISCS SEIZED IN CAPTIONED MATTER. 5 
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[CHARGES AND FORWARD THE BILL WITH A FIELD PURCHASE ORDER {FPO 
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G Acknowledge “yF¥oi Information CO Return assignment card 

D Assign (1 Reassign O Handle C Return fite C1 sertal 

O Bring file O Inktlal & return ee 

DB Call me OD Leads need attention © Return with action taken 

O Correct O Open case CO Return with explanation 

O Deadiine OC] Prepare lead cards O Search and return 

CG Delinquent Ol Prepare tickler O See me 

OQ Olscontinue O Recharge file O serial O Type 

U Expedite /3 
O File O Send to SL 
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MICRO RESEARCHINCs 


November 8, 1983 


— Bureau = Tivestigation 


300 No. Lee Street 
Alexandria, VA 22314 


Re: Computer Project 


pear} 4 


Micro Research will be pleased to help you in evaluating the 
computer materials you have in your possession. We will do it on- 
site at your offices, with the FBI providing the necessary 
hardware, software, and other required materials. . 


Point of contact will be at our office. The 
billing rate will be $45/hour to an rom Our office in Falls 
Church. Billing can be in any format acceptable to you. Cost of 
the project will not exceed : 

We look forward to helping you in this endeavor. 


Sincerely, 


Micro Research, Inc. 
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FE BW;—CONSPIRACY re A 
(00: Albany) wy “ 


Re Alexandria teletype to Bureau dated 10/6/83. 


Enclosed for Alexandria are three copies each of 
three FD-302s reflecting investigation within the Albany Division. 


Albany will forward seized evidence from searches 
conducted within Albany Division on 10/12/83 under separate cover 
per instructions set forth in referenced Alexandria teletype. 
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November 25, 1983 


FEDERAL GOVERNMENS 


} Honorable Robert E. Badhan 
vu House of Representatives 4 
Washington, Db, C. 20515 


Dear Congressman Badham: 


Your November lst inquiry regarding the fpr’ s 
investigation of unauthorized intrusions into the GTE Telemail 
;S¥stem haa been brought to my attention, — ——— 
Since this is an ongoing investigation it would be 
inappropriate for me to comment specifically on any aspects 
of the case at this time. However, I would like to explain 


the FBI's investigative procedures and responsibilities in 
guch investigations, 


When we receive information indicating that a violatfon 
of a Federal law has occurred, is occurring or will occur an 
we determine there are items of evidentiary value, we obtaig 
&@ judicially authorized search warrant for the premises where > 
the evidence is believed to be located. As with any search| ~ ,/ 
warrant, the evidence being sought must be specifically described, 

8 must the location to be searched, The time of execution f 
ef the search warrant is usually decided upon between the Es 
ma investigating Agent and the Federal prosecutor based on several. 
G2 needs, the most important of which would be the protection / 
v1 ef the evidence, Although personal convenience to the subjects 

ig a consideration, it is secondary to protection of the =. 
as evidence, When the FBI is conducting an investigation, the“. 
@& fact that some of the alleged perpetrators may be juveniles 

loes not diminish the seriousness of the crime nor does it 


MAILED 3 
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L_——-essen the FBI's responsibility to protect the victims from 
yee add LUKther illegal activity. Gh _ Y 7 (3 iy 
Exec AD tay. . ~ 
Execav les] — Alexandria (196A-633) - Enclosures (3) - / bé 
Ave Dire 1 - Los Angeles - Enclosures (3) bic 
1 ~ Administrative Unit, CID - Enclosures (3}—=== ===" : 
Room \ 


1- - Enclosures (3} - TO .DEG 15 1983 
1 - Congressional Affairs Section © Enclosures (3) 

Lege! Coun. oo oe 

patent, — BSHsrs (8), 
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4 oF 
Director's Sec'y MAILROOM 


Training 


. “Hondsable Robert g. Baghan 


- ¥ hope tha abege information wil, ‘be of ‘selp to. 

: you. fa eorresponding with your constituents, I€ you have 

. any agai tionad questions, Please do not, hesitate. to Sontact | 
Bes : oon 


dineegely yout’, . 
; > 


. Oliver ‘B. Reyekl 
. see ba | , baeiptane Dizector . 
nC ‘Criginal Investigative ‘pivision 


“NOTE: Above response suggested by sali white-Collar 6 
Crimes Section, CID. |The Congressman encloses.a copy of . Lb7c 
a letter he has received from a number of his’constituents —~ aan 
“with regard to the manner in which: the FBI. recovered. computer 
‘equipment ‘which. was allegedly. used, in’ tapping into the com ~ . 
mercial Telemail system run by GTB.“ He asks that the letter 7.2. 
. and the néwspaper article entitled "FBI storm tactics Ang 
‘Trvine® ‘be: ‘Feviewed ‘and’ comments furnished, . : 
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Date vember 1983 


TO: DIRECTOR FBI (196-4578) 
ATTN: TECHNICAL SERVICES DIVISION - ROOM 7159 


PROM: SAC, SAN DIEGO (196B-1018) (P) 


MAIN FRAME? . 
FRAUD BY WIRE; CONSPIRACY 
00 : Alexandria 


UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE 
AND ELECTRONICS {GTE) TELENET SYSTEM OF 
CUSTOMER COMPUTERS; 

PRAUD BY WIRE; 

ITSP 

00 : Milwaukee 


- Re Bureau airtel to Alexandy 3 et al, dated Ootoper 74h 
1983. we tte 
4 G bo. SY eae [ fr | 

Re communication requested that any evidence seized, 
during the investigation of captioned matters, be reviewed so 
as to assess any entry made into Department of Defense (DOD) 
computers. The brochure enclosed with the reference reviewed 
as to alpha listings and numeric listings. The evidence seized 
by search warrant in the San Diego Division revealed.now =~" * 
evidence which would substantiate a successful entry into the 


sae 
Peay ompakes systems by the subject in the San Diego FAP FARR g@ eR 
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3 Bureau | 
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2 - San Diego . A 
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UNAUTHORIZED ENTRY INTO GENERAL 

TELEPHONE AND ELECTRONICS (GIE); 

TELENET SYSTEM. CUSTOMER COMPUTERS; 

FRAUD BY WIRE;, ITSP . 
(CO: MILWAUKEE) : 

MI File: 1968-798 

BU File: -196-4578 


Re Director airtel to Alexandria dated 10/27/83. 


Boston. fumetioned as an auxiliary office in the above oagin ed 
Milwaukee case. Therefore, Boston is, not in possession of any mi fos 
to review. 

It is noted that the above referenced communication indicated. that 
two enclosures of a sensitive nature were attached to the airtel. However, 

' Boston received only one enclosure which was a blue covered pamphlet containing 
a a list of letters and numbers titled alphabetical listing. It appears from 
the above referenced communication that Boston did not receive a separate 
enclosure which contains a numeric listing that is a Ys on" sequence, £0 
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BS 196B-1160 


the computer. A search was conducted at the Boston Division for the 
missing enclosure. 


It is believed that the enclosure was inadvertently 
left off the airtel. 


No further investigation outstanding in Boston. This matter 
has been placed in an RUC status. 
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FBW; CONSPIRACY 
OO: ALEXANDRIA 


airtel to the Director, 11/14/83. 
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al @)- Bureau 


Re Director letter to Alexandria dated 10/27/83, and 
Alexandria airtel to the Director on 11/14/83. 


Phoenix Division is unaware of any additional 
information concerning hackers entering Department of Defense 
computers other than that provided by Alexandria and Alexandria 
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ATTNE-—NEY YORK, HAUPPAUGE RA 


(on , : - Dizdclor's Sep. 
. "MAINFRAME 3/FRAUD BY WIRE CONSPIRACY (G0:AX) [AS a 


RE ALEXANDRIA TELETYPE TO THE BUREAU, OCTOBER. 6, 1983. 


INVESTIGATION IN THIS MATTER HAS REVEALED THAT THE TRUE naw 


orl diz 
CL —™~™”_]AND WAS PRESENT DURING THE SEARCH 


OF THAT PREMISES QN OCTOBER 12, 1983, 


[kas Toto sal_——S—S—S=i@S:SCKAUPPAUGEE. RA, THAT HE WOULD 
CONSENT TO BE INTERVIEWED IN THIS MATTER. joy _ 47 2s ead | oe 


[_xas usep NUMEROUS ALIASES ON GTE TELEMAIL INCLUDING RIE 


GROUP OF HACKERS AND’ PHONE FREAKS KNOWN AS THE "PHALSERS”, 
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PAGE. TWO AX 1964-633 UNCLAS | , Tee 
[____]aL so IS REPORTED TO KNOW THE TRUE NAME OF[L_ ‘| aNOTRER 2S, 
SUBJECT OF THIS INVESTIGATION. 

DUE TO THE COMPLEXITY OF THE CONTEMPLATED INTERVIEW, INVOLVING 
NUMEROUS ADDITIONAL UNSUBS AND OTHER COMPUTER SYSTEMS, IT WOULD BE 
IMPOSS BLE TO PROVIDE ALL NECESSARY BACKGROUND INFORMATION TO AN 
AO CASE AGENT. , 


AUTHORIZATION IS THEREFORE REQUESTED FOR. sal sid 


To TRAVEL TO NEW YORK'ON DECEMBER 29, 1983, TO CONDUCT SAID INTERVIEW, .\ 


WITH ASSISTANCE FROM ® HAUPPAUGE RA AGENT. SAC, NEW YORK, AND SAC, prc 
ALEXANDRIA, CONCUR. IF AUTHORIZATION IS GRANTED saL_ [WILL 
BE ARRIVING AT ISLIP-MCARTHUR AIRPORT ON U.S. AIR FLIGHT 17% AT 
9:99 AM ON DECEMBER. 20, 1983, 
LEADS: - : 
NEW YORK AT HAUPPAUGE RA: WILL SCHEDULE INTERVIEW wITHL | 
, bé 


[____] For DECEMBER 29, 1983. prc 


ALEXANDRIA REQUESTS THAT. SA[____JBE MET AT ISLIP-MCARTHUR 


AIRPORT AT 9:89 AM ON DECEMBER 28, 1983. 
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To F. Revell Date December 8, 1983 Ligucon, 
Off. Cong. & 
A Public Affe. 
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Training 


- Telephone Rm. 


Director's See’y — 


Subject: | MAITNFRAME;\FBW; CONSPIRACY; OO: AX 


PURPOSE: 


To respond to the Director's request for comments by 
providing a current update on captioned matter which involves 
the unauthorized accessing of the General Telephone and Electronics 
Company (GTE) Telemail system, ‘ 
fue 
RECOMMENDATION: 


None, for information only. 
: ar 


Me : = 
. in, 
Exeé. AD-Adm. ident. Ben Mont 
fe } Exec, AD-iny, Inspection Tech. Servs. 
Exec, AD-LES tntait. Training 


DETAILS: . 


GTE owns and operates a computer network known as Telenet 
which links various subscriber businesses and government agencies in 
numerous cities. Within Telenet is a service known as Telemail which 
offers computerized message capability a; res customers. 


. a . - £Llé=h : : 

An investigation. since August, 1983 by Alexandria“detérmined 
that three loosely organized groups of computer hackers had been 
accessing Telemail and had been browsing, altering, and destroying 
information maintained in the Telemail system. One hacker had left 
a message that he/she would disrupt the whole system if access to the 
administrative file could be achieved. Companies and agencies whose 
records were penetrated by these hackers include TRW; NASA; TEM: 2ss=* 


#@ DEC 29 1983 


“ & FBI DOS 


to Mr. Revell Memorandum . b6 
RE: MAINFRAME bIC 


Jet Propulsion Laboratory; Northrop Corporation; Hughes Aircraft 
Corporation; U. S, Department of Agriculture; and the Department 
of Defense ARPNET system. 


As a result of investigation which identified some of 
these hackers, on 10/12 and 13/83, a total of fifteen search 
warrants were executed in nine cities throughout the United States. 
The searches resulted in seizing computers and computer-related 
paraphernalia which were utilized by the hackers to place long 
distance telephone calls and to illegally access, alter, or destroy 
information in the GTE Telemail system. The search warrant affida- 
vits specified that any computer or computer-related paraphernalia 
was to be seized and that the unauthorized accessing of the Telemail 
system had resulted in violations of the Fraud by Wire Statute 
(Title 18 U.S. Code Section 1343) and the Conspiracy Statute (Title 
18 U.S.C. Section 371). 


Currently, Alexandria is in the process of reviewing all 
documents and information storage devices such as floppy discs which 
were seized during the execution of the aforementioned search warrants. 
Because of the volume of evidence seized, this review has been some- 
what lengthy and is expected to take several more weeks. Once all 
evidence has been reviewed, the investigative findings will be provided 
to the United States Attorney's (USA) Office and a prosecutive decision 
as well as a prosecutive strategy will be formulated. Thereafter, if 
the USA's Office concurs, it is anticipated that this case will be pre- 
sented to a Federal grand jury for prosecutive consideration. 


The foregoing response was coordinated with John Collingwood, 
Legal Counsel Division. 
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‘How to Punish. Computer Trespass 


When a group of Milwaukee computer 
hobbyists used their telephones to tamper 
with data stored in the computers of New 
York’s Sloan-Kettering Institute and other 
major institutions last summer, law-enforce- 
ment. officials were caught flat-footed. 
There’s no federal law against that kind of 
computer trespass, which is akin to rifling 
somebody else’s filing cabinet. 

That: may be one reason the Federal Bu- 


reau of Investigation seized the equipment of 
‘several other computer owners in ‘raids last 
month, including one'at-the State University 
at Stony Brook. In the absence of a-specifie 


law against computer offenses, the FBI re- © 


portedly planned to prosecute them under 
the laws against telephone-fraud. . 

“This showed that the federal government 
was serious about preventing similar occur- 
rences inthe future, as it should be. 

But it also raised some questions: Since 
the computer owners were neither arrested 
nor charged with a crime, should the FBI 


‘rized by search warrants. According to an 
affidavit filed with the warrant used at j 


have marched off with their equipment? 
The computer seizures were all autho- 


Stony Brook, telephone records showed that 
unauthorized calls into a national computer 
network had been placed from the home of 
the computer’s owner and from the universi- 
ty radio station where he works. 

The telephone records surely make 
strong circumstantial evidence. But the gov- 
ernment must follow up by filing charges ; 
and then show that some genuine fraud has | 
been’ somimitted. If it Tf it can’t do t that, the justi- | 
“fication for the seizures will evaporate. ! 

Computer break-ins are potentially dan- 
gerous. -They facilitate various economic 
crimes as well as violations of privacy. Com- 
puter hobbyists with no criminal intent may | 
inadvertently wipe out valuable informa- 
tion. But the punishment should -fit the 
crime. If that means new laws are needed, 
it’s up to Congress to provide them. 


fb. YB - AD 


_ Eger AO Adm, 


Exec AD lav, 


Exec AD LES —___ 


Legel Cau. 
Off. Cong. & 
Public Affe, 


Training 
Telephone Re. 
Oirector's Sec’y — 


7 EDITORIAL 


The Washington Post 
The Washington Times 
Daily News (New York) 
The New York Times 
The Wall Street Journal 
The Chicago Tribune 


The Los Angeles Times 
The Christian Science Monitor 


USA Today 


eRe Page 


Mews oar 16 


Date ___d/-/9-83 


FBYDOS 
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FD-36 (Fev. 8-2 : r 


‘| GRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 


“ 0 Teletype OC Immediate te 
O Facsimile : C Priority 


(k Airtel’ O Routine 0 
O UNCLASEFTO 
UNCLAS 

Date 


12/19/83 


To? DIRECTOR, FBI 


SAC, ALEXANDRIA (196A-633) (P) 


FRW; CONSPIRACY , VLY 
(00:AX) 


Re. Alexandria teletype to the Bureau, 10/6/83. 
Enclosed for the Bureau are two copiés of an FD-515 


- and one copy of an internal GTE letter regarding captioned 
matter. 


Soares 


For information of the Bureau, investigation in 


a captioned matter led to the execution of 15 searches on 

‘ 

g 10/12/83, and 10/13/83. 

A : 

Q The searches resulted in the seizure of computers 

a and computer-related paraphernalia at all locations. The 
seizure of the equipment effectively stopped the continuous 

XY quip! P 


and daily unauthorized access to the GTE Telemail eys em. bé 


= fh . bIC 
stated-that the majority of Telemail customers (and, approximately 


17 of the 19 customers mentioned in enclosed letter) can 
terminate their accounts with 30 days written notice. There 
are some customers (2 of the'19 mentioned) who are “re-sellers" 
of service and have a one year contract. 


fen BF - 9b 


\ 

of Ne cpl 

Gpureau (Enc. 3) the 
1-Alexandria 

GDF:gaj . 

(3) \ 


Approved: A) A- Transmitted . Per 


(Number) (Time) 


AX 196A-633 


stated that representatives of American Hospital 

Supply Company (AHSC), NASA, Raytheon and other companies 
contacted her and were extremely concerned about how long 
the intruders were going to be in.their accounts. It is 

opinion that, had the hackers not been identified 
y the FBI and prevented from accessing Telemail by the 
seizure of computers, a significant number of the penetrated 
companies would have terminated their Telemail services. 


bE 
bIC 


As stated in the enclosed GTE letter, the financial 
impact of the unauthorized: accesses extended far beyond 
the immediate revenue loss of affected customers. The.potential 
loss is based on a loss of customer confidence in the security 
of the system, resulting in the termination of customer , 
accounts and/or failure to obtain new customers. 


That potential economic loss has been prevented 
by this investigation in that the vast majority of intruders 
were identified and had their computers seized. Further, 
GTE officers report no unauthorized accesses occurring since 
the date of the searches. This is attributed to a deterrent 
effect created by the media coverage in this case. 


2* 


oN, 


GTE Telenet 
Communications Corporation 
C. Thomas Tay!or ~ . 8229 Bocne Boulevard 
Vice President, Vienna, Virginia 22180 
Network Applications & Terminals +. (703) 442-1245 


9 September 1983 


| . a 
bic 

@lenet ae 

Program Office 


8229 Boone Bld. 
Vienna, VA 22180 


SUBJECT: TELEMAIL SECURITY INVESTIGATION 


Analysis of the financial impact of the current Telemail security problem indicates 

that nineteen customers have been affected. The monthly revenue for these customers 
as of July, 1983, amounts to $297,971. Assuming that on the average, each of these 
customers would continue to use the service for minimum of three years, this equates 
to-a potential loss of revenue from this customer group of $10,726,956. 


The three year impact amount is actually understated in that many of the nineteen 
customers are in their introductory phase with Telemail and would logically grow 
substantially over the July 1983 billing amount. 

In addition to the customers that are directly affected, the entire Telemail business 

is indirectly affected by the severity of the security problem. In attempting to 
estimate the potential damage to the entire Telemail business, I have assumed a 50% 
loss factor pertinent to the 1984-1988 period. This amount consists of $189,500,000. 


Please let me know if you require additional material on this subject. 
Sincerely , 


be 
b7c 


PNL.BL 


bor 4713- ait 


A part of Genara! Telephone & Electronics 


\ ACCOMPLISHMBMT-REPORT 
(Submit within-30%ays trom date of accomplishment: 


DIRECTOR, FBI ance or Techniques Used 
Goroau Fila Number} |Wore any of the investigative assistance or techriques lated below used in connecton with accomplishment 
losing claimed? C] Na Yves it Yes, rate each used as folows: 
1 = Used, but dis not help 
FROM: (x2, PRAME oo” 196A-633 2 = Helped, but only minimally 
SUBJECT: MAINFRAME jf” aon erones 2 = Helped, substantially Te. Snow Mone; 
oid Office File Number : i. Usage 
Y 4 = Absolutely eseentat 
EBW; CONSPI RAC . 3. Aectg Tech; 6. ELSUR- 7. Lab Div 7. Survet 
(COGTAX) nesses Tite in Fiat Suppoq Sad Asst 
03 oo 7. Fyprosis, ria Pan (8. SWAT Team] 
‘Squad o7 RA Number Assistange ‘Assistance Registers: Action 
~ 1D - xitajont FBV0EA tor Comper @ den Be 73, Photograph Telephone T bTE 
8 Bie ROLFBUDEA Cr. | assistance Assistance Coverage Records 
R ‘operation. [4. Consensual @. informant 14. Polygraph PO. Undercovar 
. Ol .xit case invowas Monitoring slntormation Aasistanco Operation 
comuption of a pubic iv 
5 Sitcial (redorat’ State or |S EXSUR - fi0. Lab Ov 1S. Search Wan} fat. Visual & 
va) cecal FASC Exams Executed Analyste (VI 
[A. Preliminary Judtotai Procees Complaints [informations [ tnciotnonts Tp, Recoveries, Restitvtions, Cour Ordered Forfoltures or Potential Economic Lows Prevented (PELP) 
(Number of subjects) -— 
[Property or 
1B. Arrests, Locetes, Summonses Subject Priority (See Reverse} EL Type] Potential Economie 
& Subpoonee (to, of eubjectey x a = Code Recoveries Restiutone __| Court Orderes Forteiures| Lows Provonted 
$ $ is $s 
FBI Arrests 27 10,726,996 
s $ i$ 1S 
F81 Locates 
s $ is S$ 
‘umber of Subjects of FBI Aroote Whe Physically Resistad 
‘Number of Subjects of FBI Arrests Who Ware Ammed. $ $ $ $ 
Grlminei Summons ‘Subpoenas Served $ s s 
IC. Release of Hostages: (Number of Hostages Released) E. Clvil Mattors Government Detandant Government Praintift 
Armount of Suit i$ is 
Hostages Hots By Terronsts All Other Hostage Situations 
‘Settoment or Award $ $ 
Enter AFA Payment Here 
F. Final Judlelal Proc Judicial Bistdct {Use two fetter state abbreviations per U.S. Post Office Guide. For Example - The Northern Disticl of Texas as ND TX; The 
\ Disvict Stata Distict of Meine as ME in the state fit only.) 
‘Subject 1 - Name - ‘Subjects Description Code * - 
Convtetion Tedell Term Buspended Probation 
Fetons 
o owes + Convictions - 0 Y Fite Section Counts ¥rs_| Mos vis__|_ Mos vs Mos ON Fine 
warsion} | Enter conviction and Mise: Ss 
A oemiss] | Stntnce ata apace at I) tevncr i 3 
eater} |right t mer tan for hh 
sections afe iwotved, titto [[-] Pree 7 
trevor mostrve, | fe 
Tiel 
Is r 
[__Swblect 2 - Name ‘Subject’s Description Code * - 
io Conviction Tedall Tern Suspended Probation 
Pretial . Convettons - C1 Fewey rte ‘Section Counts Yes | Mos. Yrs |_Mos Vs ‘Mos Fine 
a OWwersion| | enter conviction and CO Mace: is 
oO Dismissal sentence date in apace et meanor 
Acauital | fright. tt more than four Is 
sections are invotved, timit tof] Plea 7 
a fi 
Thal x 
\WIs—- LA 
ria 
[([Subiect 3 name FE! Subjects Description 
Condetion Zell Term Suspended Prabation 
CI Premias <Gonvietions- — [CA Fev (Fie Section Counts {vis [Mes | ve [mos [| vo | mos Fine 
ln OWersion| | Enter conviction and Msc is 
Dismissal] sentence deta in space at meanor f 
(1 Acquittat | Iright, If ore than tour ‘ 
sections are involves, imi to} [Pea 
tho four most relevant i 
Attach edditional forma if reporting final judicisi process on more than three aublects. 


Remake: 
oA 

6 ane ose or 

Feo onex Alexandria {1 - 196A-633) {l - Statistics in Process) GDF:gaj (4) 

* See codes on reverse side. Subject description codes in Section F are. requires only when reporting a conviction. 


** identify the other Federal Agancylies) in the Remerks Section + Fel/Dos 


Property Type Codes* Potential Economic Loss Prevented (PELP) Type Codes * 
Code Code 
No Description No Description 
1 Cash (U.S. and foreign currency) 21 Blank Negotiable Instruments or Tickets 
2 — Stock, Bonds or Negotiable Instruments (checks, travelers checks, 22 Counterfeit Stocks, Bonds, Currency or Negotiable Instruments 
money orders, certificates of deposit, etc} 23 Counterfeit or Pirated Sound Recordings or Motion Pictures 
3 General Retail Merchandise (clothing. food, liquor, cigarettes, TVs, etc)} 24 Bank Theft Scheme Aborted 
4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) 25 Ransom, Extortion or Bribe Demand Aborted 
& Heavy Machinery & Equipment (heavy equipment, computers, etc) 26 Theft From, or Fraud Against, Government Scheme Aborted 
6 — Bulk Materials (grain, fuel, raw materials, metals, wire, etc} 27 Commercial o Industrial Theft Scheme Aborted 
7 Jewelry (including unset precious and semiprecious stones) 
8 Precious Metals (gold, silver, silverware, platinum, etc) 
9 Art, Antiques or Rare Collections 
+0 Dangerous Drugs 
11 Weapons or Explosives 
12 Businesses or Assets Forfeited 30 All Other Potential Economic Loss Prevented {not falling in any 
20 All Other Recoveries (not falling in any category above} category above} 


* The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this 
report if the recovery is $1 million or more, or if the PELP is $5 million or more. 


Subject Description Codes * 
- Enter Dascription Code Only When Reporting » Conviction - 


Organized Crime Subjects: Union Members: 
1A Boss, Underboss or Consigliere 5A International or National Officer 
1B Capedecina or Soldier 5B Local Officer 
+C Possible LCN Member or Associate 6C Union Employee 
1D OC Subject Other Than LCN Government Official Or Employees: 
Known Criminals (Other Than OC Members): 6A Federal - Elected Official 
2A Top Ten or 1.0. Fugitive 6B Federal - Nonelected Executive Level 
2B Top Thiet 6C Federal - All Other 
2C Top Con Man 6D State - Elected Official 
Foreign Nationals: 6E State - Nonelected Executive Level 
3A Legal Alien 6F State - All Other 
3B WWegai Aten 6G Local - Elected Official 
3C Foreign Official Without Diplomatic Immunity 8H Local - Nonelected Executive Level 
3D U.N. Employee Without Diplomatic Immunity 64 Local - All Other 
3E Foreign Students Bank Officers Or Employees: 
3F All Others 7A Bank Officer 
Terrorists: 78 Bank Employee 
4A Known Member of a Terrorist Organization All Others: 
4B Possible Terrorist Member or Sympathizer 8A Ali Other Subjects (not fitting above categories) 


“If a subject can be classified in more than one of the categories, select the most appropriate in the circumstance. 


Instructions 


Subject Priorities for FBI Arrast or Locates: 
A - Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in 
the past five years. 
B - Subjects wanted for crimes involving the toss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past 
five years. 
CG - All others 
Claiming Convictions Other Than Federal: 
it is permissible to claim a local (state, county or local) conviction if the FBI's investigation significantly contributed to the successful local 
prosecution. A succinct narrative setting forth the basis for claiming a local conviction must accompany this report. When claiming a convietion 
other than Federal, enter the word “LOCAL” in the “Conviction-Section” block, disregard the number of conviction counts, but enter the sentence 
in the appropriate blocks. Enter “LF” in the "In-Jail” block for all life sentences and “CP” for all capital punishment sentences. 
Reporting Convictions: 
Convictions should not be reported until the sentence has been issued. There are two exceptions to this rule. The conviction information can be 
submitted by itself if: 
1. The subject becomes a fugitive after conviction but prior to sentencing. 
2. The subject dies after conviction but prior to sentencing. 
An explanation is required in the Remarks section for either of the above exceptions. 
Rule 20 Situations: 
The-field office that obtained the process (normally the office of origin) is the office that should claim the conviction, not the office where the 
subject enters the plea in cases involving Rule 20 of the Faderal Rules of Criminal Procedures. 
Investigative Assistance or Techniques (IA/Ts) Used: 
-Since more than one IA/T could have contributed to the accomplishment, each IA/T must be rated. 
-The |A/T used must be rated each tlme an accomplishment is claimed. (For example - if informant information was the basis for a complaints en 
arrest, a recovery and a conviction and if separate FD-518s are submitted for each of the aforementioned accomplishments, the “Informant 
information” block must be rated on each'FL-515 even if it was the same information that contributed to all the accomplishments.) 


a 
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FBI 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
O Teletype C Immediate OT 
O Facsimile Q Priority oO 
a] Cl’ Routine Cg 
O UNCLASEFTO 
O UNCLAS 
AIRTEL Date _12/29/83 _| 
TO : DIRECTOR, FBI 
(ATIN: TECHNICAL SERVICES DIVISION, ROOM 7159) 
ine 
FROM :-SAC, ALBANY (196A-677) (P) 


SUBJECT: da teeRaue 
FRAUD-BY WIRE; 
~. GONSPIRACY 
(OO: ALEXANDRIA) 


Re Alexandria airtel to the Bureau dated 10/27/83. 


by the Albany Division were reviewed 


to entry imto Department of Defense Computers and 
Vera negative. 


Copies of evidence seized from 


Lo Jnaveriais contain the following notations: 


7 - Bureau 
 - Alexandria 
{1-1L96A-633) 
2 ~ Albany 
RAH:dld 


tigation in the Albany ie vi 


ROUTING ont 


Approved: gornap LE INT Transmitted 
: aaly.s-c¥ {Number} (Time} 


- SAC, Alexandria 1/12/84 


( Director, FBI 


6 vi 
MAIN FRAME 
DBY°WIRE; CONSPIRACY 


00: ALEXANDRIA 
AX File Number: 196-A-633 


b6 
Tc 
UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND 
ELECTRONICS (GTE}; TELENET SYSTEM CUSTOMER 
COMPUTERS; FRAUD BY WIRE; ITSP 
00: MILWAUKEE 
MI File Number: 196-B-798 
. Bufile: 196-4578 


’ “" ReBulet to SAC, Alexandria, et. al., dated 10/27/83, 
captioned as above, in which recipients were requested to furnish 
information regarding computer hackers. 


To date, only four recipients have responded to this N 

request. It is imperative that recipients of instant letter s 
submit their responses immediately to the Technical Services 9 
Division, Room 7159. 3 
> 

Baltimore 2 - Newark eo 
Boston 2 - New York bye z 
Buffalo 2 - Oklahoma City-—~___ a 
Detroit 2 - Omaha is 

Los Angeles 2 - Phoenix ws 
Milwaukee 2 - Tampa fe, 


Rm. 3841, TL #231 


1376, Ma Yao | b7c 


RM. 


Exec AD Adm. —__— 


YRECORDED COPY F: 


Exec AD lav. F coo 
Exec AD LES —__ ae ca 
Asst, Dir 2 JAN IS 1904 
Adm, Serva, 
Crim. tay. 
Legal Coun. 
‘Off. Cong. & ° 
Public Alfs. —— 1 s OR 
Roc. Mgnt. ——— GY? __ EN 
Tach. Servs. 904 
Training gat Ve 
Totophone Rm, be 
Director's Sec’y MAIL ROOM 


Airtel 
Unclas 
pifestor; x 


a vu 
ria (196-633) 


FBW; CONSPIRACY; 00: AX 


Re Alexandria airtel to the Bureau, 12/19/83. 


A review by PBIHQ of the recently implemented parameters 
concerning PELP claims indicates that AX'x PELP claim on the FD-515, 
which was enclosed with referenced airtel, cannot be accepted. 


Under the new PELP guidelines, implemented for fiscal year 
1984, any theft scheme against a commercial or industrial firm that 
is aborted by the FBI prior to its fruition will be claimed as a PELP 
only if the specific value of the loss can be firmly stated. Addi- 
tionally, all PELP claims, no matter the value, must have a justifi- 
cation which will concisely explain the circumstances of the PELP and 
the value claimed. No claim will be allowed based on an estimate. 


Although GTE states their potential loss was over $10 million, 
: that figure is an estimate of possible logs and does not refer to a 


Pe 
bad 
fa) 
td 
=! 
< 
= 


Exec AD Adm. 8 cman ee 
Exec AD Inv. 
Exec AD LES —__ 
Aaah Dine gs jan & 984 
Adm. Servs. 
Crim, tov. eae a 
dent, fond 


Legal Coun. 


OFF. Cong. & B.%, ee : XS 


Publle Alls, —— 


Rec. Moat. 
Tech. Servs. 


a a? 


Director's Sec'y MAIL ROOM 


wy 
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-FBI 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
0 Teletype [1 Immediate O fT 
QO Facsimile QO Priority Oo 
@ Airtel 0 Routine im 
O UNCLASEFTO 
UNCLAS 
Date January 17,; 1984 
‘po: DIRECTOR, FBI (196-4578) 
ATTENTION: TECHNICAL SERVICES DIVISION bé 
ROOM 7159 
. BTC 
FROM: SAC; MILWAUKEE (196-B-798) (P) 
sussect/ “MAIN PRAME,-/ 
FRAUD~BY WIRE; CONSPIRACY 
00: ALEXANDRIA 
AX File Number: 196-A-633 ’ 
bé 
b7c 


UNAUTHORIZED ENTRY INTO ‘GENERAL TELEPHONE AND 
ELECTRONICS” (GTE)@)"TELENET SYSTEM CUSTOMER COMPUTERS; 
FRAUD BY WIRE; ITSP . 


00: MILWAUKEE (4 


Re Bureau letter to Alexandria, Et Al, dated 10/27/83; 
Milwaukee airtel to Bureau, Et Al, dated 11/8/83; 
Bureau letter to Alexandria, Et Al, Gated. 1/12/84. 4) ¥ 


. SP EA 
The above referenced Milwaukee airtel to the Bureau was 
in response to the Bureau's initial request for information in 
the letter dated October 27, 1983. If the Bureau has misplaced 
referenged airtel, a we has been enclosed. 
cuir, 


EAU (Encl. gile0s 
LWAUKEE (196-B-798) 


Transmitted 


‘y y yo 


’ 


6) UNRECORDED COPY FILED IN. / 


(Number) (Time) 


san com 


@: Milw. kee (1968-798) 
6S :cal At 
+ a7) eee 


a Approved: 


Q Teletype 
O Facsimile © 


DIRECTOR, FBI- 


(ATTENTION: | TECHNICAL SERVICES DIVISION, 


“SAC, MILWAUKEE (1968-798) (P) 


UNAUTHORIZED “ENTRY ‘INTO 
GENERAL TELEPHONE AND ELECTRONICS (CTE) , 
TELENET SYSTEM CUSTOMERS’. COMPUTERS + 

FRAUD BY WIRE; ITSP . 
00: 


MILWAUKEE 7 : : : 
Re Bureau airtel to Alexandria, dated 10/27/83. 


“Milwaukee has reviewed seized materials and found no. 
references to Arpanet-linked systems. 3ureau shou! 
be advised that the most capable hacker who is cooperating - 
in this matter destroyed all records before consenting to_ 
interview. Also, the hacker subjects believed to have 

breached the system operated by Los Alamos National Laboratory 
are not cooperating and have not been served with, ‘nor are | 
they likely to be served with, search warrants. 2 


: * Because ‘auxiliary offices” in captioned matter have 
no subjects in their divisions in this case, They, will. have no 
seized materials t review 


- Bureau | 
-~ Albuquerque 


Boston 
Dallas 
-. Newark 
- New York 
~ Tampa 


NPN NN Aw 


“Tranemited _ 
aa (Number) 


11/29/83 


70: “DERECTOR, FBI 


FROM: : @e, ‘BOSTON | 960-1160) ox 


*™ Director afrtel to Mexandria dated 10/27/83. 


Bostoh Ametioned as an “gudilary office in the above captioned 
" witwaskee cose Bezatne, San nn onsen omy oo ria 
to review. : re 


“Tt is noted that the above referenced 


-. _ t 


8s 1969-1160 . 6 ® 


the computer. A search was conducted at the Boston Division for the 


ing enclosure. It is believed that the enclosure was inadvertently 
left off the airtel. 


No further investigation outstanding in Boston. ‘This matter 


Memerandum @ . . ®& 


To DIRECTOR, FBI Date 1/19/84 


Fro vA fc, BOSTON (196B-1160) {RUC} 


Subject : dam FRAME; 
FBW7 CONSPIRACY 
00: ALEXANDRIA 
AX: 1960-633 


™ mw 


\ 
Oo 
™ 
UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND DO 
ELECTRONICS (GTE); TELENET SYSTEM CUSTOMER COMPUTERS; ~ 
FBW; ITSP J 
00: MILWAUKEE t 
MI: 1963-798 
BU: 196-4578 SS 
~ 


\ 
Re Bureau letter to Alexandria, 1/12/84 anda Boston 
airtel to the Bureau, 11/29/83. \ 


UNPECORRED C77 


Enclosed for the Bureau are two copies of Boston's 
RUC airtel dated 11/29/83, which responded to Bureau letter 
to Alexandria, Et Al, dated 10/27/83. The airtel is self-explanatory 
in that Boston, merely being a lead office for Milwaukee, 
had no information relative to the request of the Bureau. 


O- sue emeges J 16° YN3- 2 . 


2 - Alexandria (196A¥633) 
2 - Milwaukee (196B-/98} 
i - Boston 

WGS/dw 

(7) 


@4AF RBA 1984 


FBV DOS 


AXO 622 621 B@19Z 
PP Ha 
DE AX 
P 29 22002 JAN 84 


UFFALO PRIORITY 
i venbors PRIORITY 

LOS ANGELES PRIORITY 

NEW YORK PRIORITY 

OKLAHOMA CITY PRIORITY or 
ONAHA PRIORITY 
PHOENIX PRIORITY 


SAN DIEGO PRIORITY. ~ 


BT 


UNCLAS . : 
AINFRAMES FBW3 CONSPIRACY (OO :AX). bs 
. Cc 

RE AX TELETYPE TQ DIRECTOR, JANUARY 20, 1984, | 


ALL RECELVING OFFIQES WERE REQUESTED TO H 
AND SIGN A “HOLD HARE Ss" AGREEMENT PRIO 


R 
QUESTION or gee QB 4rHE vaoonserd Menai 


a? JAK. 24. 1984 


ORES acs at 


_PAGE THO ax 1968-635 es | 


f REQUEST “HOLD HARMLESS" AGREEMENTS. 
RECEIVING OFFICES ARE REQUESTED TO RETAIN EQUIPMENT WHICH 15 . 
BEING SHIPPED TO THEM UNTIL ALEXANDRIA CAN OBTAIN CLASSIFICATION, 
ALL OFFICES WILL BE NOTIFIED, ASAP. 
BT 


erat é . ) 
AXOVG6 B201726Z Swe 


= 
RR HQ AL BU DE LA NY we iSI3) 


iv 


DE ax : UN df 7 39> 


R 26/7262 JAN 84 e 5 
bec caasber C196A-633) CP) “s 
4I DIRECTOR ROUT INE : 
ALBANY ROUTINE /e 


BUFFALO ROUT INE VLA 


Telephone Rm. 
Director's Sac'y ——} 


TETROIT (28E~347) ROUT INE 

LOS ANGELES ROUT INE 

NEW YORK ROUT INE 

OKLAHOMA CITY (196A- 1278) ROUT INE 
OMAHA. ROUTINE 

PHOENIX ROUT INE : 

SAN ‘DIEGO (1968+ 1813) ROUT INE 

BY 


UNCLAS F ry 


ATTN: NEU YORK, BROOKL YN- QUEENS (RA 

H ive INFRAME} FBW; CONSPIRACY (00:AX) 

Nee sh State ; 
RE ALEXANDRIA TELETYPE TO DIRECTOR, OCTOBER 6, 1983. i 


\ FOR INFORMATION OF THE BUREAU AND ALL RECEIVING OFFICES, mm 


/76 ~ 13-89 | | 


J . 
va @ 9 


PAGE TWO AX 1964-633 UNCLAS 

ALEXANDRIA HAS COMPLETED REVIEW OF EVIDENCE SEIZED IN CAPTIONED 
MATTER. ALEXANDRIA IS RETAINING PRINI-OUTS, NOTES, FLOPPY DISCS, 
ETC., FROM EACH SUBJECT THAT HAVE EVIDENTIARY VALUE. HOWEVER, 

AT THE REQUEST OF THE UNITED STATES ATTORNEY, EASTERN DISTRICT 

OF VIRGINIA, THE COMPUTER HARDWARE AND NON-EVIDENTIARY MATERIAL 
ARE BEING FORWARDED TO EACH OFFICE FOR RETURN TO OWNER AT THIS 
TIME. EQUIPMENT IS BEING SENT FROM ALEXANDRIA VIA BUMAIL OVER 
THE NEXT TWO WEEKS. 

LEADS: 

ALL RECEIVING OFFICES ARE REQUESTED TO: 

1.) RETURN EQUIPMENT TO OWNER AND RETAIN A RECEIPT FOR 
” RETURN OF SAME. 

2.) HAVE OWNER INSPECT EQUIPMENT AND SIGN A "HOLD HARMLESS" 
AGREEMENT STATING THAT HE/SHE HAS “INSPECTED EQUIPMENT LISTED 
ABOVE AND FOUND IT TO BE IN SATISFACTORY CONDITION. £ FURTHER 
AGREE TO HOLD HARMLESS THE UNITED STATES GOVERNMENT FROM ANY 
CLA IMs CONCERNING SAID EQUIPMENT”, OR WORDS TO THAT EFFECT. 

, 3.) IF OWNER IS UNWILLING TO SIGN SUCH A STATEMENT, THE 
EQUIPMENT WILL BE RETAINED BY LOCAL OFFICE UNTIL FINAL ADJUDICATION 


OF THIS MATTER WITH RESPECT TO THAT SUBJECT. 


~4”" . . q @ 
PAGE THREE AX I6A-633 “UNCLAS 
4.) FORWARD TWO COPIES OF ABOVE RECEIPTS TO ALEXANDRIA 
WHEN OBTAINED. 
or 


sss 


EN 
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TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
OC Teletype _O Immediate a 
Q Facsimile O Priority ob 
} AIRTEL - O Routine o 
QO UNCLASEFTO 
OQ UNCLAS 
Date _1/24/84 | 


so 
TO: DIRECTOR, FBI 


FROM: SAC, OMAHA (196A-922)(P) 
see . Le 
tf SUBJECT: MAIN FRAME? 

Y PRAME 
: FRAUD BY-WIRE; CONSPIRACY; 
6: 00: ALEXANDRIA 
AX File Number: 196A-633 


b6 
BIC 
ET AL; . 
. UNAUTHORIZED ENTRY INTO GENERAL 
é TELEPHONE AND ELECTRONICS (GTE); 
TELENET SYSTEM CUSTOMER COMPUTERS; 
FRAUD BY WIRE; ITSP; 
OO:' MILWAUKEE 
MI File Number: 196B~798 
Bufile Number: 196-4578 


: . Re Bulet to SAC, Alexandria, et. al., dated 10/27/83 
and Bulet to Alexandria dated 1/12/84. 


For information of jvisigh gonducte 
a search of the residence of concerning 
the MAIN FRAME investigation conducte y the Alexaridyjia Division. 


All items seized in this search were immediately sett Eo flexandwia. 
: Accordingly, there is no way to determine if hackere/ inyédved 
in instant matter had made entry into the DepartmentyofDefense 
computers. In addition, efforts to interview were négative, 


as he was instructed by his attorney not to consent to any inter iewsp 
by the FBI. 
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Report of: SA Office: Alexandria, Virginia on 
Date: 2/17/84 


Field Office Fite #: 196A-633 Bureau File #: 
Narrative of Offense: 


General Telephone and Electronics (GTE) owns 
and operates a computer network known as Telenet which 
links various subscriber companies and Government agencies 
through a tie-in system in numerous cities throughout 
the United States. Access is obtained by calling a published 
telephone number in various cities. 


Within the Telenet System is a service called 
Telemail which offers a computerized message capability 
between Telemail customers and any Telemail subscriber 
company. Each Telemail subscriber is responsible for 
designating an "in house" administrator to oversee all 
administrative functions of the customer's Telemail service, 
including the assignment of passwords to gain access to 
the system and the subscriber company. The administrator 
for a new user company may set up various subdivisions 
and individual users in his own company as he sees fit. 


In August, 1983, GTE discovered that the accounts 
of approximately 18 Telemail subscribers had been accessed 
by unauthorized intruders from different areas of the 
country. The intruders gained access to certain customers' 
Telemail subscribers accounts by determining password 
assigned to Telemail subscribers through a process called 
"hacking". By this process, the "hacker" chose a subscriber 
account, such as Raytheon, NASA, USDA, RADA Corporation, 
Coca Cola USA, 3M Corporation. The “hacker" then tried 
numerous successive passwords (e.g., each letter of the 
alphabet, or the administrator's first name, etc.) until 
the correct password was discovered. Many hackers programmed 
their home computer to systematically try passwords for 
hours at a time. Once the hacker had broken a customer's 
password, he entered the Telemail System as if he were 
the legitimate subscriber. He did this by calling a published 
Telenet dial-in number and then placing his telephone 
on his modem hookup. This modem hookup allowed him to 
type on his home computer keyboard and have the impulses 
sent through the telephone system into the Telenet computer 


Bei 
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system. He then typed in the command "Mail" and entered 

the Telemail message system. At this point the computer 
prompted him with "User Name?". He then typed in the 

words (for example) ADMIN/NASA. The computer then prompted 

with "Password?" and he then typed in the password that 

he had discovered through hacking. At this point he was 
accepted by the system as a legitimate subscriber, and 

was able to perform many of the functions that the subscriber 
can perform, all of which would be charged to the legitimate 
subscriber. At this point some of the hackers created 

a pirate subdivision in the legitimate subscriber organization, 
such as ADMIN/inner circle/NASA and set up user names 

in that new "pirate" account. User names may be any compilation 
of letters and numbers, but are_usually a first initial, Be 
period, then last name Co The hacker, bre 
as administrator of his own subdivision, then set up passwords 
for all his users, notified them of their user name and 

password and they could now enter Telemail with their 

names and passwords. These users could now leave messages 

on the system to an individual in the group, to the pirate 
administrator or (because the computer believed they 

are legitimate) to any other user (legitimate or illegitimate} 

in the entire Telemail system. 


On October 13, 1983, immediately before FBI 
Agents began a search of the WUSB Radio Station, State 


University _of New York at k, Stony Brook, be 
New York,| tod eo, gavin ehae a 
room and remove certain items From that room to prevent 


those items from being seized. did remove certain 
items from the room. 


described as: 
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pater Birt 
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described as: 


Qe so 

Date of Birth 
Octal Security 
«Account Number 


Address 


be 
bICc 
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described as: 


Race A& 
Sex 
2st 
Date of Bixk 
Height 
Hair 
Eyes 
Address 


b6 
b7C 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


3, 1983, the premises located at 
and WUSB 
Radio Station, State University of New York at Stony Brook, 
Stony Brook, New York, was searched pursuant to a duly 
authorized federal search warrant and various computer 
paraphenalia were seized. 


be 
b7c 
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WITNESSES: 


1. 


2. 


3. 


4. 


- —_ 


8229 Boone Boulevard 

Vienna, Virginia 

Telepnone[———] 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


Special Agent 
Federal Bureau of Investigation 


Can supply details of investigation. 


— Agent 


Federal Bureau of Investigation, New York 
Can supply details concerning search of WUSB 


Radio Station, State University of New York 
at Stony Brook. 


Special Agent 
Federal Bureau of Investigation, New York 


Can su details concerning search of 


Can supply details of admissions made by 
[ite him, as well as details about 
extent of intrusion into GTE Telemail by 
and others. 


Full text in report section, pages 7 - 16, attached. 


ev\ 


be 
bIC 


be 
b7c 


bé 
b7¢c 


be 
b7c 
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6. 


Telephone 

Can provide details of use of telephones 
and _computers_at WUSB, as well as details concerning 
Lena [~~ Jinvolvement in removal of 
evidence prior to FBI search. 


Full text in report section, pages 17 - 18, attached. 
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EVIDENCE: 


ry of 57 messages placed on _GTE Telemail 
b (originals in possession off sd 
GTE Telemail). 


2. Copy of 302 concerning search with attached 
list of items seized. 


3. List of items from WUSB Radio Station, State 
University of New York, relevant to Telemail (originals 
in possession of Alexandria FBI). 


4. List of items from. SSCS ree evaant 
to Telemail (originals in possession of Alexandria FBI). 


i charges for 
(original in possession 6 : 
6. Co of messages sent to GTE Telemaii[ | 
{originals 
in possession oO : 


7. Copy of investigative reports provided by 


C4 Attorney for State University of New York at 
Stony Brook, concerning 
8. Copy of letter fromn[ =i enclosed 


copy of "2600" magazine. 


9. FD-302 summarizing trap and trace information 
received fron 


and 


be 
bic 


be 
bic 


be 
b7¢c 
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FEDERAL BUREAU OF INVESTIGATION 


12/14/83 


Date of transcription. 


1 
The followi. i sag £ the 
illegal user known as and on Pe 


the GTE Telemail System. 


synoposis 


1. 


3. 


The date and time of each message is provided, with a 
of particularly significant messages included. 


July 9, 1983, 11:42 p.m. (All times Eastern Daylight Time) 
This message discusses a Source Account and states 
in part "Some of you mentioned hacking timecor and ve 


task force. What exactly are those and how 2 
accessible? I await your replies." Signed 


July 10, 1983, 4:28 a.m. Message reads as follows: 

"Hi, folks -[ fon assignment. The foliowing 

will either 5e Teng and boring or informative and b6 
interesting, or maybe a combination. Looks like b7C 
Southern Bell has some sort of relationsnip with 

Telenet." This is followed by a forwarded message 

from the Telenet Company that discusses "Southern 

Bell marketing opportunities for 1983/84." 


duly 14, 1983, 5:41 p.m This is again a forwarded 
message concerning the Telemail Account of Citibank. 


July 15, 1983, 3:21 a.m. This is a forwarded message 
from to all members of the Phalse group. 
The message 18 a listing of the projections of the 
1984 Telemail Revenues. This message lists every 
current and projected Telemail account number and the 
projected revenue for 1984. 


July 15, 1983, 3:25 a.m. This is another message from bé 
a fe all members of the Phalse group, concerning pic 
Telenet information. 


be 
bICc 


July 15, 1983, 11:27 p.m. This message discusses the 
idea of a publication called "2600 Magazine” with articles 
to discuss phone phreaking and computer hacking. 


investigation on 


ZuBe 
12/8/83 at Alexandria, Virginia ,,,, Alexandria 196A-633 


be 
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Continuation of FD-302 of ..__Summary of Messages. _ _- 07 12/34/93. . Page 2 
7. July 16, 1983, 11:47 p.m. 
8 July 11, 1983, 1:02 a.m. 
9. July 16, 1983, 2:07 a.m. This message reads in part, 
"Yes, I have been thinking about distribution. So far 
we have reliable boxes in Colorado, Chicago and 
Long Island. I'm looking for a way rignt now of opening 
up a box in Grand Central Station or something." This 
jeessage goes on to discuss ways that mail would 
immediately be forwarded to a different post office box 
so that the boxes could not be traced. 

10, July 18, 1983, 3:02 p.m. This message states, 
ig the ID for the space station information." Signed b6 

b7c 

ll. July 18, 1983, 8:10 D.a. 

12. July 18, 1933, 10:47 p.m. This is a message from 
cof The message begins,| _|( from ani 
continues, ive thanx, that you're not wanted dred (Sic) ve 
or alive. I'll be jammin with you tomorrow. Time to bIC 
draw my brakes. What a plot! Police and thieves on my 
back. I gorse go back home to my tenament yard. 

23. July 24, 19833, 11:16 p.m. This message states, "I found 
this somewhere, but can't seem to get the procedure 
right. Any suggestions?" This is followed by the listing 
of a Telemail customer, computer application services and 
passwords for that customer. 

14. July 25, 1983, 2:38 a.m. 

15. August 2, 1983, 2:49 a.m. This message is entitled, “Your 
Talenet Guide,“ and discusses administrative functions 
of the Telemail system. 

16. August 3, 1983, 1:30 a.m. 

17. August 4, 1983, 4:05 a.m. 

18. August 5, 1983, 7: nm. I his message[_ jis asking bs 


aka what the price range ig 
for printing stationery. m a@ previous message, | pre 
indicated that[__|worked in a print shop. 
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Summary of Messages _ On__12/14/83 Page 3. 


Continuation at FO-302 of 


ig. 


20. 


21. 


22. 


23. 
24. 
25. 
26. 


27. 
28. 
29. 


August 8, 1983, 2:ll a.m. This message refers to 
and “hacking up a storm" on "Black". 
ack was their pseudonym for an IBM voice message 


system they were illegally using. ae 


b7Cc 


August 8, 1983, i0:13 p.m. This message reads ag 
follows, but Phalse isn‘t known by anyone 
yet. Is it? This is really the only place I've 
seen mentioned of it, unless they have bugs on 

ADS (which I really doubt}, there's no real record 
Phalse anywhere. I think perhaps we should change 
our mame when hacking perhaps, but then again it's 
always possible that some faithful follower 
(Phalse «rou 3) will do things in our name (or 
we could say chat, anyway!)* 


August 17, 1933, 19:13 p.m. 


August 21, 1923, 11:45 p.m. This message discusses, 
"Green, gold, and black.” hese are IBM voice 
message systems that these people were using illegally. 


August 23, 1933, 9:48 p.m 
August 24, 1983, 11:34 p.a. 
August 26, 1983, 4:45 p.m. 


August 29, 1983, 4:17 p.m. This message is entitled, 
"Arpa" and states in part, "I was able to get inside 
theix Centrex using that 800 number I told you about.” 


August 31, 1983, 12:43 a.m. 
August 31, 1983, 4:08 p.m. 


August 31, 1983, 11:20 p.m. The statement reads in part, bé 
"Hi,[ _} Good to see you got onto the system alright. bic 
Welcome to the Phalse network. Our purpose is to exchange 
all kinds of info as quickly and efficiently asa possible. 
This system is one of our resources. If you'd like 

to see some of the stuff we've been up to, look in EMLE. 

The PW is the same as yours when you logged in.” 
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Summary of Messages .On 12/14/83 Page 4 


Continuation of FO-302 of | _. 


30. 


31. 


32. 


33. 
34. 


35. 
36. 
37. 
38. 


September 8, 1983, 3:56 a.m. 


September 8, 1983, 5:37 a.m. In this nessage| | 
forwards a message from a Telenet official to 

Telenet users discussing unauthorized access to customer 
computer systems. 


September 8, 1983, 16:15 a.m. This message reads as 
follows, “The situation at Telenet continues to be 
unsettled, as those of vou on the ‘A’ System can see on 
the BBS. Therefore the the moratorium against hacking 
Telemail accounts has been extended until the end of 
September. At that time, we can continue with a vegence 
and introduce the new people into the ways of the . 
*usercode.' . 

A new Arpa update has been sent to those currently 
involved in the TAC HAC Project. We still do not have 

a date on password cutover, although the end of the year 
has hinted at for MILNET implementation. We still need 
guest accounts on MIT and SRI hosts, as well as a new 
FTP NOCS. Anyone with info on any of these should pass 
it on via the Arpa list. 

And last but not least, another reminder not to take the 
Telemail Customer Survey they are touting on the BB. 

It is partly designed as a trap to validate authorized 
system users, and our unregistered area which stands 
out like a sore thumb should they take a closer look. 
Later, all." Signed, and is followed by 

*P.S.: OSUNY Lives!" 

September 11, 1983, 5:13 p.m. 


September 11, 1983, 5:19 p.m. This message states, 
“Folks, should we risk sending to these pecple from 
our own accounts? Personally I'd feel better if we 
had accounts over in their area in case as a clampdown 
Pe soap thins Please let me know the facts." Signed, 
September 12, 1983, 8:00 p.m. 

September 12, 1983, 11:51 p.m. 

September 13, 1983, 5:26 p.m. 


September 14, 1983, 11:30 p.m. 
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Continuation of FD-302 of ..__ Summary of Messages 


39. 
40. 
41. 
42. 
43. 
44. 
45. 
46. 
47. 
48. 


49, 
50. 
sl. 
52. 
$3. 


54. 


55. 
56. 
57. 


September 
September 
September 
September 
/ September 
September 
September 
September 


September 


with each 


-On__L2/14/83 page __§___ 


17, 1983, 
17, 1983, 
18, 1983, 
18, 1983, 


13, 1933, 


24, 1983, 
25, 1983, 
27, 1983, 


28, 1983, 


2:06 a.m. 
9:36 poem 
16:05 p.m. 
10:05 p.m 
2:03 a.n. 
$:34 pom. 
8:51 p.m. 
5:54 p.m. 
11:21 p.m. 


8:29 p.m. This message is an exhortation 


September 29, 1983, 
by|____|tor all members of the Phalse group to use 6 
the illega 


systems more frequently to keep in contact 7c 


other. 


September 30, 1983, 5:23 p.m. 


October 1, 1983, 3:22 a.m. 


October 3, 1983, 12:05 p.m 


October 6, 1983, 12:13 a.m. 


October 10, 1983, 1:42 a.m. 


Octok 


Octoper 10, 1983, 7:05 p.m. This massage is from 
a) a states, "Can we talk via be 
Vo sometime soon ave me a MSG somewhere.” bie 


is 11, 1983, 1:11 p.m. 


, 1983, 11:56 p.m. 


October 12, 1983, 12:13 a.m. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 
10/25/83 


on October 13, 1983, at 11:55 AM, a search warrant was 
executed ah room 249 of Student Union Building Number 37 at the 


State University of New York at Stony Brook, New kK, cial bé 
Agents (SA's) bic 
Co Jana No vertinent property was found at 


this location. 


of WUSB, advi that 
shere was nersonal computer equipment belonging to 
in room 227 of the same building and that the telephones 


in room 227 were part of the same system as those in reom 240. b6 
indi ed that ne had control over room 227 and would pic 
allow access. He proceeded to give his written consent for the 
Special Agents of the Federal Bureau of Investigation (FBI) to 
enter room 227, 
At 12:30 OM, Magistrate SHIRA A. SCHEINDLIN of the 
Eastern District of New, York at Brooklyn, New York, was contacted 
telephonically by Special Agent and advised of the change b6 
in room locations and of consent. SCHEINPDLIN proceeded bic 
fo authorize a search of room 227. 
At 12:35 PM a search of room 227 was begun and the 
search was terminated at 2:15 PM. The search and inventory of bé 
property taken were made in the presence of a bIc 
volunteer employee of WUSB and part time user of the computer 
system. 


At the time of the search, the Special Agents observed 
that the computer system in room 227 was connected to the 
telephone system, 


Attached is a copy of the inventory of the property 
taken from room 227. 


F-7 
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KU 
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FEDERAL BUREAU OF INVESTIGATION 


pate of transcription __11/14 /83 


The following is a review of items seized in a 
court-authorized search of the WUSB Radio Station premises 
at the State University of New York at Stoneybrook on 
October 12471983. The following items of relevance to this 

@ investigation were found: 


1) A computer print-out labeled "Telemail System 
Command Manual,” printed September 20, 1983. This print-out 
contains all Telemail System commands. This information would 
normally be obtainable only by a legitimate Telemail administrator. 


2} This item is another copy of the "Telemail System 
Command Mariial:* 


3) A computer print-out titled "CP/M Modem Program 
Version 7.4." This is a program that will automatically search 
for other computer numbers through the telephone system. 


4} A computer print-out beginning "Welcome to My Data 


Base Sy: * t-out also contains the statement pe 
"Bello. Pre 
5) A print-out entitled "Free Access Computerized BBS 
Directory." Copyright Peter J. Keller. This print-out also bé 
bears the address Data Base System, care of Tower Systems, bre 
196 Main Street, Lincoln Park, New Jersey 07035, followed by 

the words Modem: 201/694-7425. 


6) A whi i ddress:[ sd . 
i = b6 
is addressed to WUSB Radio Station, Attention: bic 


7) A print-out titled "Jerihug Computer Club Finances 
as of 6/10/82." This print-out contains a list of names and expenses. 


8) A box of business cards labelled "Litel Systems, 


Incorporated, 285 Locust Driv: so 
has the name b6 
and the telephone rm er b7c 


11/10/83 a Alexandria, Virginia 


Alexandria 196A-633 
Sub E 


b6 


> SAL Far pote aicatea__11/14/83 bre 
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9) A computer print-out listing numerous bulletin 
boards and telephone numbers. 


10) A computer print-out of telephone numbers, including 
numerous Telenet access numbers and Arpanet access numbers. 
This print-out also includes a handwritten note: 914/725-4064, 
Osuny. It also bears the number 800/424-6000, followed by the 
words Telenet 800. This print-out also has a “Connect address” 
for the Source. 
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FD302 (Rev. 3-10-82) @ @ 


FEDERAL BUREAU OF INVESTIGATION 


13/14/83 


Date of transcription. 


The following is a review of items seized in a bé 
search of[ = bre 


1) : . . e 
numbers for bé 
an b7c 
2) A yellow piece of paper with the words 
{__Janafor [ }* and the area code 213 follow beé 
phone numbers. One of these numbers is area code bic 
3) Photocopy of article entitled "Telecorder" with 
a typewritten note signed was a member of the 
Phalsers who went by the user name b6 
bic 


4) Telephone bill for the number[ si 


dated August 22, 1983, with toll charges. 
5) White envelope with the number[ son it. be 


6) 1982 personal pocket diary off —iSS pie 


7) A New York telephone brochure with numerous 
telephone numbers written on it. 


8) Telephone bill for number[———=éd;s dated 


June 22, 1983. bé 


b7c 
9) Telephone bill for the number[_ sdb 


dated April 22, 1983. 
10) ‘Telephone bill for above number, dated May 22, 1983. 


11) Telephone bill for above number, dated 
February 22, 1983. 


12) An orange 3 by 5 card with numerous names and 
addresses on it. 


11/10/83 Alexandria, Virginia Alexandria 196A-633 
at File # Sub—e 


a 1114/3 bs 


by Date dictated bIC 


Investigation on 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is foaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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13) A computer print~out starting with 
"Dial Your Match Commands" and the words "TUC BBS," followed 
by a phone number. 


14) A small scrap of yellow paper with the number 
ion it. 
A whit £ paper with t 
(illegible), 
= A_brown = of _ with the address 


bé 
b7c 


be 
bic 


bé 
b7c 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 
1 : 
= pate of tramiertotian 2/20/84 
The “floppy discs" that were seized in search 


of the WUSB radio station at the State Univergi 
York, Stony Brook, New York, w examined by be 
a computer programmer. indicated that the discs bic 


appear to have no information on them pertaining to GTE 
Telemail. 


1/17/84 . Alexandria, Va. alexandria 196A-633 
a ile ® 


investigation on 


. b6 
» i <5) 1/17/84 bre 


Date dictated 


This document contains neither recommendations nor coactusions of the FBI. tt is the property of the FBI and is loaned to yous agency; 
it ang its contents are not to ve distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


ate of transcription__1/ 31/84 


gn January 24, 1994[7 
C= GTE-Telemail, provided a copy of the amount of money be 
st 


fo) y GTE Telemail from the unauthorized use by the hackers. bic 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
i ating totals by seach user, combining multiple user names 
s summary covers the months of July, August and September 


for each company}: 
BP AMCUNT MONTHS 
$62.29 July. August, 
September 
$31.00 September 
LC] Maraven $l@.00 August, September bé 
cat : 1 Septom — 
$108.00 July, August 
| $0,29 September 
$127.58 
| cBOT $2.00 September 
bé 


| RADA $1.00 September b7c 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July b6 
7c 
Telenet $151.00 August 
SAE 
Savestigation on 1/25/84 «Alexandria, Virginia rite e Alexandria 196A-633 
bé 
by SA stk pate cictarea__ 1/25/84 BIC 
This document contains neither recommendations nor conclusions of the FBI. 11 Is the property af the FBI ang is loaned to your agency; 


it ane its contents are not to be distributes outside your agency. 
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AX 196A-633 2 
USER COMPANY AMOUNT MONTHS 
BMW $55.00 September 
(Continued ) 
BMW $40.00 August 
Maraven $1.00 September 
| BMW $4.00 September 
BMW : $1.00 August 
| Raytheon $19.00 September 
| Scannet $2,00 September 
$621.00 
LC] Maraven $0.17 August 
Telenet $144.00 July 
Telenet $59.00 August 
CL BMW $11.00 September 
| UAW $5.00 September 
Cc Scannet $6.00 September 
$225.17 
| BMW $3.00 September 
BMW $0.17 August 
Maraven $1.00 September 
Maraven $8.00 August 
| Maraven $132.00 July 
Maraven $37.00 August 
| AHSC _$15,00 August 


b6é 
b7c 


b6 
b7c 


be 
b7C 


AX 196A-633 


USER COMPANY AMOUNT MONTHS 
CL | AHSC $0.55 September b6 
bic 
Telenet $92.00 July 
Telsanet $21.00 August 
AHSC $6,00 August 
$119.55 
[|] AHSC $64.00 August b6 
bIC 
AHSC $10.00 September 
Raytheon $5.00 August 
Raytheon $7.00 September 
RADA $1,00 September 
$87.00 
b6 
| AHSC $88.00 August ec 
| cBOT $6.57 September 
RADA $115.00 August, September 
AHSC $35.00 August, September b6& 
bIC 
BMW $20.00 September 
| MMM $3,00 September 
$179.57 
| cBOT $86.00 September 
RADA $8.00 September . b6 
. B7C 
L_ | MMM $3,00 September 
$97.00 


AX 196A-633 


USER COMPANY AMOUNT MONTHS 
| cBOT $103.00 September 
RADA $4.00 September be 
BITC 
| MMM $7,00 September 
$114.00 
LCL] CBOT $87.00 September 
RADA $18.52 August, September 
LC] RADA $0.76 September bic 
oT cBoT $287,00 September 
$393.28 
CL CBOT $2.00 September 
. RADA $3.00 September 
bé 
| CBOT $0.90 September bic 
RADA $0,12 September 
$6.02 
| AHSC $27.00 August, September 4, 
b7 
MMM $5.00 September © 
RADA $2,00 September 
$34.00 
Ld RADA $8.00 August, September 
CBOT $0.17 September bE 
b7e 
CL MMM $0,42 September 
$8.59 


AX 196A-633 


{un 


USER COMPANY AMOUNT MONTHS 
| Raytheon $5.00 September 
AHSC $4,090 August, September 
$9.00 
es $4.50 August, September 
, RADA $0.12 September 
| Raytheon $1,00 September 
$5.68 
C7. Raytheon $109.00 September 
CL] Raytheon $41.00 September 
| ; Raytheon $107.00 September 
| Raytheon $76.00 September 
es cBoT $0.29 September 
RADA $85.00 August, September 
$85.29 
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bé 
b7c 


be 
b7c 


b7C 


, b7C 


b7Cc 


FD-302 (Rev. 3-16-82) 


FEDERAL BUREAU OF INVESTIGATION 


i Date of tanseription_1731/84 


On January 24, 1984, 


bé 
[___] GTE Telemail, forwarded copies of the attached Telemail prc 
messages. 


Review of the messages indicates that contact with 
GTE Telemail was made by a group using the name "Pha 


. 
"Members of Pha " soon stated they could be eatiea{ | bé 
| or This person then began usin 


an intermediary 
to deliver the messages. 


b7c 
b7D 
as w nfidenti ' b6 
b7C 
b7D 
In the series of messages attached, [__Jaanits b6 
to frequent and pervasive intrusion into the Telemail system, 


7c 
and also admits to reading the internal messages of legitimate 
users of Telemail. (Specifically, AT & T Long Lines.) 


Investigation on 1/25/84 a Alexandria, Virginia rie e Alexandria 1964-633 
Sub E 
oy-__ SAL Esk ote sitatea_1/25/84 bs 
BIC 
‘This document contains neither recommendations nor conclusions of the FBI. {t is the property of the FBI and is joaned to your agency; 
it and its contents ave not to be distributed outside your agency. 
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AX 196A-633 ~ ATTACHMENT 
Sub E 


Mor Rey 7 


b7Cc 


NTU ALL 
HL 
D LIBRE 


LY WANT To 


WMMUN TTA LL . 
y pen eo b6 
b7C 


DuHI FE? 


WHE 


OC 


DECF! 
i dumpmet 


Enter SMN sr <ORD te step? peaid- 


OEE 


VIDED THrs 
CALL MY Wee 


NO TDRNTISY ¥ 


2040 
4 


UL NOINMAL TOL 
> 7 ,.WoLILD £ 
XFECT THAT Yi W 
ILL RAVE 
CTANCE TS 


oR RO OR ROK Oe 


cS 
* 
- 
r 
¥ 
4 
* 
YOUR MOTIVES: ARE £ 
* 
# 
* 
# 
oa 


and 


P-2) 


b6 


2EOD OAOT OAR “9 SS44 474) 2aas 4FSs a 


S354 4F4E On0A 


Enter 


EMNi MGI 153 
Fosted date: November 
Delivery tptioansi? 


Leryn 


erpaes 


4 


eave cal 
eS with wou. To * 
es atoend. To ha * 
* Jesal mails ® 
SOTt # et up ¢# * 
BSD * onder a 
# priendgie, The FOF 
H aasuar ed for ths ” 
eb is the sian- ¢« 
e off vou. .used uh # 
* en itacted # bé6 
2O7S TE7zE FOAL # ased ueon ur 1 o# 
722% 6540 7320 Re etter, it seems * 
OR72 GE74 2061 # vou..represent a # 
2067 726F S70 ZE2O 2047 GFAE S774 # erouR, lo donvt * 
2060 496E 6420 7441 éCheE &720 744F # mind talking to # 
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206% 6172 
6ESt 74469 
eF72 6420 


OTA 
7420 


4 
Ale 


TEES 6C8: 
SEOD GAG O6ar cE 7 f 
741 7E6G Dore Eo o17t 4 
EO aie 
Dy crane aa Lae 


SNECTED 


user name L | 


Password? 


Name of RPastuerd invalid. 


® 


wher tel sau. ta 
care af disse 


&, 
Os. the pas 


Mensa + Fs 
CHECH tutbetin meards: 
TELENET 
Ne, Delivered From Subject 
i Nev 


Qemmand? 


User’s catalog. 
Command? s alt 
Nothing Found in tulletin board. 


Command? s pursed 


sword to your ar 
OYP MEeMbererecae 
Rather than get 

inte the m@etaiis 


cor yr 


wid rat 
aarti 
veloP a 


whookina 


ine 


abRe 


Eauipment Fickup 


YOR PRK ROR 


x 4% 


‘ @ 


bé 
bic 


Lines 


[ _— “ 


WE CAN NOT GET INTO THE ACCOUNT, 
SOVISE, 


PHALSE 


Cemma rid” 


mr Lae 


ise the delay in respondina 


S)eace 
rather hectic lately. We do hope ven 
"hart cos reerondyna and far fetta 
Amat tad) fseme Qo hot stranas te 
noth We frees that all part 
w thie 


cametstet - han 


* acrually see 


chan emnt te tee 

aeons ryty ate Ree 

cote ce ea a Ch 
- Ronee rank 

teers ms - 


Sep hy ma 


co onetoet 


ut 


° sdee 


vote rece 


eh Ina mie PRAM aoe mre 


te fer thee untinver rete 
APs yohs, We ve mear 
watyna a tresven a ward peorses 


ar ald te dnowith ans of this matter - 
tspenden animation. There are many a 


hac be 


nm made. 


TELEMARL was nut an end in itgelf ta uw 
was fact, efficient, and convenient (1 
seldming for individual cameuter cwner 


Senin, we dent knew what other peneis 


rt was, thrvet, it could certainty hay 
erecantions on yaur part. We wantd ne 
these and oon the workings of your syst 
must know if thers is any chance oF ¢ 


Please advise and forward this te all 


Yours, 


The members of FHAISE 


Preted: Sun Nav 27, 1% 


eerem, War pi 


trocveuy be 


naderstand, 


ne? ap 5 seecdsl curb o£ 
actuadiw trays 


yes inveadved us lio mabe 


4 a “leaal" 


aes 
ee te vn. th 


' Vast mem 


pager te eca mar 
ss ore ea. rhe 


Rea FQbk Gee 


Fore pana 


comp pa re pe ms 


meer, Th re 


ROTA poe. = 


wever thinness have beer 


rabine 


Setomrth concen ina phye 
eet th ee 
nw pat at hone eT 


serel 
at 


erees. 


ren much erelyerty coaraeny na 


luet omhar earna 
Sr time,  Gepreave at fa 
aovged erymar pis fer the purece pi 

suen Veurrancurrmveny) ! 

2 aftia t 

of? Gj 


Phar 


meee Lt 


fer ernepame rhat s68 neanea ene 


dopeenrrs 


Por Seren wr wae 


Of -- a Perean whe Nad notnyne 


and 2 new biviese oon virtual 


ther such cases: tur the 


§. We simetly vsed it becawree tt | 
noract. we Feel it’s a Potential 


1S) 


Ss as well as cerpeperati 


€ heen curtailed via a Ff 
mare than harper te advis 


Pp 


1a 


em in generals hewevers we 


interested parties. 


F~25 


rant 


were actually deine.  Whataver 


email 
yey oon 
really 


uipment being returned in the future. 


3 12953 PM EST treent Msat PHID-1591- 39773 


be 
b7¢ 


PH. FHRASES/ASSONIATES b6 
ry e eS 


aOPS 


i 
ne should have sent the main message as URGENT with a RECRIFT, thowever. 
“2 anofed, this one will have the rereipt., The follawina messace 
= the ureent one. 


ent at the reauvest of PHALTE ry _d (Give my resarde 


“4 : weed) 
: and b6 
b7C 
Yroupe 
ral om ea7 Meat MIL MAb Sola ee 
Lo TATES b6 
bie 
ao. PMeneynaep 
eT Ty SR nach ERT oe Fe 
wy ma are 
eb iret Te brea thee cemmaere arrived ont tole, 
Tammi tte peccened ae an pmtiyyatual a fore Adyar s 
Meer Wiel pe fhepe aye 
bé 
b7C 


Urart Reepense to PHO oe 


“es request honesty in cur cammunicatiaons, loam stad ta offer ite 
sepectally if To can evrect it fram you, Hewevers very Tittle, if anvthing. 
van be said about any investigations. ‘We will do methine te jecpardize 


current oc future investigations 


rt is a business As such, we expect the users of the system will only be 
these individuals authorized hy Telenet. You mention that a few small 
erecautions on our part could curtail unauthorized intrusions. Please 
comment further on this, as I suspect you are quite expert on the toric, 

You also point out the usefulness of the system to business and Personal 
computer ufers, The current uses of the system hy cur customers are aiready 


Fis- 


To don’t knew if TELEMAIL is a soldmine, as you sussest in vour letters but | 


@:: appreciate Your conmen @ on this tapi 


site varied, but I woul: 


this call for the return of esuipment, citinea it is anty 
the time fer unauthorized breaking and entering. First, how «ften da 
vestars” toots, suns and hambe have te be used tefore ther are ransidered 
Is there any dtirterence hetween burslars' teels and TP st 
the esurpment is used te treak and enter inte a erivate 
equipment erimartils 


used five percent af 


vangerous 
syipment, wher 
system? Second, To wander faw many individuals use their 
hacking activities’ The chaileness of hackine are often 
(Precsvsms of Creativity, ag fom ture 


Acie faund ebeeubers 
“enh WeIne a camputer tip mare useful 
Imagine wnat mrant have been accomplished jf allo oof the brame 
had neen channelled inte cametnin® aeace 


on are Aware, 
edt atilitv ¢Pent of hackina 
enmetructivea. 


Bo rseutt ot leering rhete 


¢ far aS fnmacent penglo custaryne harm 
ayypmenr, T syagect that tnase ronmerd et 
atorcan te arraneed with the aut 

s the material is ngeded by ¢tudent 


the peaeie at Teleanet wren mare ta ne 


Services, and Frigg cts is 
s fe have rie fear uinaurter ss 
evetom, 
ek arom seen Hei SR eee, OF oe Gag * ae 4 
cenupaaad 6 uss at,  F syessen oe: . 
ht the easemord Sretrpyoutren, is morte: 
conan cate pe the accent ye uead hs Cre eer 
aye are, Fo dane t pes < wee - 7 


“hed te hades) ve mere 
carm oF the definition te rou, 


bé 
bic 
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Fasted: 
Frome 


Attorne. 


emnush 
Put sne 
due ern 


ta ask 
to tédi 


Poa. 7 
Ambassa 


Fosteds 
Frame 


is 


Tue 


lan 


ele 


a are 
ta eve 
thing 
cess, 
suesti 
them: 


ell th 


dors s 


Tue 


PARRY. or Tas pee 


that of treat fer 


ersat for with 


oS e «our MT, mtn 


tela oie 


we have 
and it has 
ans ghout thar and we 


eto 


gecept thar eerhars 
ese gshvs over on Ext 


was.... 


can 


oh 


that there re 


rea 
te 
an 


fet te use firet nanee as 
houtd boow betters. arter all. 


1 


e 


EB kee ree 


oe Lotaae -. 
a thet pave tren a3lereat, 


VES ere 


eealty at lees ag 
priced eervar ds 


attics oF he Phescoene 


Meas ABTA pups — 


stions trv ashing |(name taken from the novel 


Sounds Jike the FPHALSeErs want toe hele! HA HA 


ey did anvthiss wrong... (the d hacker rationale...) 
Towish there was some way te get across ta him that be war cemelerct 


weena in his Cand has friends) Behavior. Ch wells... 


an fare, Tovar gef.re 


bE 
BIC 


eure 
Sunt ' 
Fest 


vois int : 
what wer - 

at? Whew! PUAN. 
arn] dras, ete. and any tumentum that c . 
system hacrers will te last, Me ows ef ois That Punishment sheal| 
be as swift and sure az earsible whl fare, The i oneer 


my make these peop hackers wait far g¢ v oO5e inedittments tp 
more Peo,ed ther will eet. Mou the the other hand 
will tase their fear and want ro wna allo ouver again... 
There needs to be some sort of mati earine heogee for 
with computer fraud and tel HURT LC abuse that ts fund 
a caonsartium of all telerhene company ated data cammoncations 
The kind sf abuse that To am daily in cantact with is mind heestin 
Tf it is any conmsntatian, the trials and tritulations 
are nothing campared te what is still haprenina on ather 
every day! 


ta woekssee 
Toad aff 


(Weil Fo will get down off my saaprh 

Sorry about the cutburst, but I have 

me mind ta keep my sanity in this incredible mes 
F29 


Youre. 


bE 
bIC 
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be 
b7c 


Mes? WOID-1 


Frome 


b6 
b7C 


Tabet Eternal Communication 


Seon. bé6 
Tag b7c 


For mane 
defavit 
ter as On sens 
aamicietratecs whe uneittise!ly 2 hoothe SMS 
ther were being overheard. 


fhe 


Tn wha 
7 blishing 


av 


way it war dis 
deus blunder ter 
customers Tt simpiv was mat realistic te expe and 
te tabs we responsibility changing them. One of there 
(NAGA) sant urgent messages to its members imploring them 
their easewords. Eut it was teo late. While NASA, be inevitably 
changing their passwords structures had prevented efurther® breabhings 
there was very Jittle that id te dune regarding intruders that had 
already settled down in seldom or never used accounts. What’s more. 
such People actually followed NATA“s advice and chansed their rPasswerd: 
thus clesing of f the account to the original gunners whe they heped- 

: os P-31 . 


would try once, fail -@.. ins mutter something WW ircanre about computers 
and their creators, and then go back to his typewriter. 


Mast of the TELEMAIL hackers did mot do anything malicious. However, 
we did hear reports of some recple who sent silly messages or tried te 
start fights among legitimate users, FHALZTE people were especially 
concerned about this, since everyvonee“s "safety" on the system was 
being compromised. When the crackdown came as it undoubtediy would, 
all of the hackers would te deemed as bad as the very worst. And so 
it went. 


Administrator accounts proved ta be rather easy ta obtain as well, 
either the same "A" default ar same mathematical eauation invelving 
the user ID number (a special codes beginning with a "#") weuld sel) 
eut the password. Naturally: we were very con “ned when the a 
Pecaple began bragging accut tting inte these ac nts. We bnew they 
weuldn’t tare the Proper erecautions and would wind up (however onwittingt ed 
causing jJamase. They were warned peatediv nat ta play arcund utere 

they mrgnt be neticed, and nat to create names that weuid attract 
attention (P.,PHRERM, H.ATRER, + Tt was naiv thank this ad 
would pe followed ta the lett toat oth 


else ue 


Ve 


Slam fb oticus 


home 


could go. 


what ve 
massage 
b6 
bIC 


b7c 
b7D 


bé 
b7c 
b7D 


b6 
b7c 
b7D 
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MY -RESPGNSE 


eecsstesese ner rere 
- — RN °C E Ta a 


CL) 


Mo suestieong vet. Fleasé cantinue. 


[| 
_ 


b6 
b7c 
bID 


b6 
bIC 
bID 


be 
b7c 


bIC 


Jon 


+ 
x 


2 


Rime & new 
Sample, le 
mould mow da 
trom ansether 
was, thus, be 


num 


wo 


ye Private 
eyt feu +t 


No matter where we ended ups theyshs the 
could nat see. And rt wae’ easy 
very practical. A sPertia) user "ai ob 
ID, It besan with a "#" and was with eve 
readout. If, anstead of the user [0, voy entered the user T 
the same information would be displayed. il that uld haw 
done te set a list of #evervbodv# would be toe keep feeding mut dirF 
user ID codes (either sequentially or randomiv) after the DIR mmarod. 
This was much easier than trving to guess names. A comeuter could 

do it willingly. But it still would have taken a very long time, if 
we had ever decided te really pursue this. We were never able ts find 
eut whether a wildcard format might werk here (DIR #°A" or DIR #7), 

hanes Meee te mente nn eee Fe 34 oe 


erm, 


In a future message, A. talk about what we ve actuarn, dvins 

2 system. For now, thoush, we would like te point out that we 
m this whole mission of discovery as an Gdventure. We were mere 
rntercested eine how many acceunts *could> be obtarnes the 
zs than we were im actually 
we df ue to attain sew 
mmynicate with already. . 


thins. 


a vs 


b7¢c 


BIC 


b7D 


if b7D 


b6 
b7c 
b7D 


B35 co vo 


nna 


— o 


(iS 


b6 
b7C 


b6 
b7C 
b7D 


b6 
b7c 
b7D 


Part 


Til 
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bé 
b7c 


be 
bic 


b6 
bIC 


bE 
bIC 


b7Cc 
BID 
b7D 
b7D 
b6 


b7c 
| BID 


Antion® Eltee 


F-38 


hs ye we 


Caetedt Sat Aa. Ve ae 

Frome PH PHRASES / Qari TA res Se 
ree b7c 
Sakis Sarre Fer Aalay, 


We are rather heey hare and wad] tre te reatin 
reve meek ontear lee can fond tre tune 


2 nur napative 
2 The Holidavs are 4 muse time, 
We are eure oon mill undearetana,  ~ater 


— re 


Umma 
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< 


ee 


llearve 


Bee Map cmat S 


Brllatee Beard 


t Vi waned 
Vober Say tpt 
toot boemat 


Pint rana eroded 


PACE Pty 


¢ RtIRGET 


pos 


ratalna, 


STMCE 


contained 


Fram 


FUBETs 


vr ome t 


etn need 
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VIM One 


6 be 
b7C 


tounge 
for deta, b6 
bIC 
Meat ceili ein nd 
b6 
b7Cc 
Mapes Maw oar t 


Bel Dine ne 
Sheard om 
mMeseron te 


ro 


are 


vies, 


“t. 


eee 


beetrnac sé 
te 


Kleaes 


Advice 


bID 


be 
b7¢ 
b7D 


b7D 


topae fleaant Meat en lpie Ow hen pied 
ete wed b6 
b7e 
wens Ly epee tae 
bé 
b7C 
ae eacse ahead reread ben 
mgd take. TSR trun ea pe artis 
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Ar Telivercead Frrm Seb iaet Linge 
(niviei phales mes ee 
mommonye an 
meeo3a abe 
Mane commintcariane va bE 
bare a BIC 
Pore 2 . 
See fer aera, - 
Pept rar 1 cmmin ea rrane , 


a . “ b7C 


— bs 


b7c 
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Posted: Fri lan 12, 1984 at 
From:- PH, PHRASES/ASSUCIATES b6 
Tas b7C 


Subst AN EXPLANATION 
Hello, 
As rou ve probably noticed: communicatians have detericrated. This has mot 


heen intentional. Events hAve transpired ta drastically cut tack access t 
system. Here is a brief explanation. 


this 


This is mmlyvy the second time that I [nave communicated wrth ras drrect} Pe 
Megane thiss Loweutd dictate my mes Swe Se Bic 
cerminai who would then send them to vou. 


over the phang to samen 


weecanths To otiscavered that this eersen was really an FRI informant. ney 

rep a time, To wasnt sure amether or nat the messages had been sent uc even ie 
the Accaunt existed. for fhe past tua weeks, [ ve Ceen scrimpine and 
faving ta eet aheld of a terminal. That accomplished, Io can mew resume 
Commynpeations. 


There have been a lot of nasty side-effects caused ty this Jatest 
however. Far one things mv REAL name and uniisted smone numoer are beina 
thrown allo owver the countrys, which 1s a tit ot 4a tether. dt sed 


“Grerts@ me at Aldo re wou Aipeagy nad trem, ERIE eo tee “See 


Lfovep were actually, eart at the FER] rope ie 
sessitrlities dent upsat me, altneuan Loda apercs 
discussinas such things. 


What does upset me, thouens is the way in which this entire thin 1s 
2einga., Apart frem the threatening calis [ set on an almost daliv basis, 
friends of mine are teing harassed because they know me. T sano t praw 


:F this is the usual FRI restine, but it seems a bit much for wnat 
wevre talkine about. 


Sar seme reason, PHOLSE is considered ty them to te some nuse and 
cangerous organization. [ don’t row haw they interereted the mescazes 
chey read, tut from what Tokneows, oathing could be furth riot Thaw 
froth. PHALIR is actuably more of 4 state of mind fhan an actual 

oreoup, but PT certainty den’ t want te bare rou uath my interereraticn. 


would apereciate any susgestions or revealing state WES yo mranht 
have at this point. Also, from now ons Io will te speaking Primarily from 
mY own eoint of view instead of claiming te cepresent the “SrauP’. 


sentinue to do that might spread the wrens idea even fucther. 


Again, thanks for sending the copies af the messages sa readily. 

They were a great help. If I’m nat mistaken: thauehs yvouvre missing 
wne after your outbound #3. I seem ta recall a message that said 
somethings te the effect of “this has been the mast canstructive message 
so far." As lona as vou remember it, ‘that’s fine. 


There are twa more tepics Cat teast] that I had Planned to address (Pre- 
ventative measures for vou & an explanation of what we were doing of 

the system). I’m horing for later on today for at least one of these. 
Purpose of this message was to Tet vou knew EXACTLY what ’s hareenings 

on this end and te try and explain the spottiness of our communications. 
Horefully: I°1] be able ta finish these messages before I get an 
invitation te Alexandria, which I’m tatd could come at any mament,. / 


Looking forward to your replys Feb3 


PLS. I’m usina 800-424-9494, Is that AK? 
P.P.5. Did vou get "2600" vet? 


Posted? Frio tan 13, tora 1:41 PM ES Msat UGIE-1597-4709 


Kp omes H. PHRASES /AS'SOIIATES 
Tot be 
mire bic 
utes? My viewrarnt 
First, a couple Points related to vaur message, IT really am mot aurte 
sure of whe veu are Call that matters 1s your experience - which 1s 
evident by rour Previgus messages -— mat yvoaur name), Podon t have vroaur 
eanane numbers and weuld tever call yvau (let alone harass youl. { can 
ASENre coy mo cone From Teleret unald call «we, es +ar as vwour allesatians 
anant the FRI, £ eersonally have & goed deal af respect alt taw 
snforcement agencies$ it is my opinion that they tave a tough jot an 
ays gon.ety, tut Tive never neem on your current side of the fence. 
boam not with the FRI, I have worked for OTE rer a number af vearss and 
im very involved with the Teiemarl ereduct - af which ( am very ereud ated 
eretatty sven a little eratective on derensive, 
fowanted te nave A dialsenue with sey eermar ily ser che repitoog fete ii 
ane The pndustre in senerai, You Nave beer invelved culth the current 
raoonoelesies and 1 am quite interzeted in vaur perspective Hew vwabrecabbe 
stems (naturally To am not without am oPinbands Mou welt 
be best frevented, etc. Loam ant trvina” 
rravcks with you - henestl Actually, To am verv appreciative cs time 
“nd effert and feel vou have a anaod deal af valuable input - tf vreau are 
motivated. The wav I have aperoacted cur relationship is that if weg 
are plavina tricks on mes so te it, I tried. Tf vou are teleina me, [ am 
anty too hapey te pass this alens te the FRI, and mavte it mrent hele me 
(naturatly, IT am met in a position te even suggest that it miraht hele 
tut Towould like to think it does. 
foam stad that vou are met usine an intermediary. That was vour 
i ved think at didn f week aut rar veu., Glee. f nave oat 
. OO’, tut weuld ceably like te Caf seurse vou cant 
ta Telemail in terms af sPeed?, 
for vour help. Tohepe we carn really get inte it. 
be 
Frio wlan 13, 1984 Msat LGIE-1597-4241 bIC 


PH, PHRASES /AS: 


Te 


stig R 


My viewraint 


IT believe in vour integrity and sincerity. Towasn’t implyins that Io didnvt 
trust you -~- [ was simply trying to peint aut how difficult it’s become to 
trust ANYBODY, That“’s ane thing I’ve learned from this whole things. Any 
time you say or do somethings: it’s always possible that there“s somebody 
taking note af it. Until recently» I would have thousht such a statement 
indicative of a Paranoid, but now I’m not so sure. 


I don’t know if vou realize or desire this -- but since my intermediary 
turned out to be an informant, that means every word that’s passed between 
us has been looked at by many others. Now I don’t have any erobtem with 


F~uy 


THiS» Out £ THeusnt rou should know, in case rou didmt already. Like 

I’ve said before, I’m ve istressed by that revela@r: most of all tecause 
that person was tryins towset me to do all kinds of tWinss on all kinds of 
systems. Fortunately, I didn“t take him ue on that offer. 


Anyway, enough of thiss I¢}]l start working on the next real message naw. 


L | 


Posted’ po oJan 15, 1924 
Frome PH. PHRA 
Tas bé 


oor b7c 
Sutest BETTING RIE OF HACKERS 


What can te done te eliminate hachers am the Tetemarll system? Realistically, 
very Tattle, Telemari is a huse evstem and nat ati of the certified users can 
be evnented to fallow the same strict suidelines for pratection, or even ta 
understand them. Hacrers thrive un chis sart at attitude, an attitude that 
wen * inanese until the averase user 1s injected with a little “hacrer 
wantairey’ himsetf.. Unce samesads sees what their weak Points are and how 
theese can be used daainst them, their erotection will tecame more ettective. 
trating a hacker's account woutd be much mare diffieuit than 
fenerrari na an average accuunt, Meet hackers fniow how and where to pretect 


ives because they 


Es ameies pene 


wonewy Shei own minds work, ‘hyetem ceergters are 
Doty aogeese This same enresiants and many times they sttain rt rhrcauar 


RO rte es per len 


disatiow hackers, che erimar 

o Caccidentally ur intentional d 
Balm access th an accounts, £ 
Send ta, tut thousands that 

mete, why should [ even brow 

With thie band of a syetems I can get a hardcopy printeut and srend 
wr the Fist tinding defaults (or, now, Finding inactive accounts 
changed their deraults) or first-name ar even user name Passwords. 
unt penetrated, more mames couid te found, As Ive mentioned 
ssagess there are other wavs Set names usina identity codes, 
that shoulda't tbe allewed, 


‘dminietrater accounts will be senetrated in the tuture., Neer as often as in 

“he est, perhaes, tut it will napeen, Masur cammanas -- deleting ar adding 
‘sers —- sneuld be Sutsect te veritination berare they’re acted upon, perhaps by 
senerating® a wessage ta fhe aaministrater' s ceal-name cunt, advising himsher 
“Fowmhat is abeut te be done. (On this supsect, I’ve heard reperts cancerninge 
new allo oof thase NASA users get deleted. Preosedty, a hacker was elarina with 
one of the administrator commands and theuent he would eliminate the termination 
dates. Soa, when he was asked for the termination date, he Ait a returns 
thinkine that that would leave it cpen. Instead. it made the termination 

date NOW and promptly eliminated all of the users in questian Tocan’t conticm 
this ~- administrater functions aren’t my specialty -- but 1f it is true, it 
indicates a sisnificant preolem with this command, i.e. the same command 

can te made accidentally ty a lesitimate administrator.) 


I’m not sure what the criteria is fer allowing use of the SET command, but it 
can be used to cover up ane af the best pretective devices currently on 
Telemail, namely the last access date. This teils a persan if somecne else 
has been usinas his account. Hawever, it can be suppressed using the SET 
command, A naive or inexperienced user misht net netice or think that something 
is wrans with the system when he doesn’t see the last access displayed. [ don’t 
see any positive appiication of this suppression? it’s oniy one line in the 
first place. 
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tries, say: nine times t ter a password for a par utar user id, a message 
should te sent to the users informing him of this, perhaps even lettins him 
know what passwords were tried, in case the hacker is getting close. At the 
same time, the accaunt shauld lock itself for a peried of time, sa that the 
hacker can’t eventually euess risht and it shauvid re-lock itself if future 
attempts are made. But the hacker shouldnt te told that he’s locked out, 
most importantly because such a message would confirm that he had a 

correct user id. 


Users sheuld knaw tf somegge i's trying te get ints ‘e: account, Ll someane 


I’m sure there 1s more on this subject that I wanted to address, tut I have te 
te samewhere else now, T° lb devote some thoausht ta anything else I want to add, 
and hopefully I°]] set ta that late tenight. Flease fet me know if vou have 
any suestions at the above or topics vau'd like me to aa aver. 


By the wav, [om naw using my semir-tocal access mumter, as requested 


Mor far 14, 19s am EST Meat CGOTE-15 
TOTES 
TATE: b6 
b7C 
METHING ELTE 
Thanks fer the onmeliranc, : 
2 bensgiogrem -- pret Tne te cr ornm the Tehbemari sreram 
motes Fest ro ream The onread command. i had 
hebievana thar rirst came seross it. It was actually 
ta Peas Someone ater Uhegr F al fo oanvedope, wittes 
ONY tracert I To thane hard fo find ah overcthercounter 
that command. were must te some Purpose to it, but the 
op the Linewead Tr OP lien, mesates that considerable, 
i 
Loden t want you te get the wrong idea, Neither Toner the people To coma } 


22a] Of time readine other pecrle’ ¢ mail. 
regirhat it mishnt have 


funreated with spent a sre 

dra th a couple. 
rally interesting 
esward of RELL o- can 
sr outhec peaple s affair 


suspe 


cone Lin 


ae) tut Fe 
om that Pater, 


CHAT Lf anevate ceally nasty and malic sot ante 


snar fom trying ta say o 
mmard would te one at 


ore stem ube ENEW what me was doing, the Unread 
sie closest friends, That, coemoined with the SET function I described 
Vier could very effectively cover his tracks. 


fing more thinset a motice of some sort when there is more than one user in an 
account should be serigusly considered. There could be fifty People in mr 
account risht naw and Id never find out abaut them. 


Tf Io think of anything else, I°li pass it alans. 


[ | 


fasted: Mon ot 16, 1984 B24 AM EST Msei EGIE-1597-5574 
Frame FH. PHRASES/ASSOLIATES be 
b7C 


an the lighter side. there are all kinds of interesting commands 
and features on this system. Some of which you may or may not be 
aware of, Odds ar most peorte don’t know about this one. 
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aee Exception: This errogyreers not occur, @ 


909 173 DISCONNECTED 00 20 00:00: 20:18 43 96 


el 909173 


909 173 CONNECTEE 


word? bIC 


Welcome to TELEMAIL! 
Your Tagst access was Monday, dan 14, ivnd 2It4 AM 


Ne mew mail, 


Tommand? RESUME 


yet 


ant 


che syétem (a Macher. of 
SGPT to create era cal 


TOUT Sey 


arned it from temena 
ies enpense 
4 


ATTENTION HALHER. T - 


MES 


1S THE FBI AND We HAY 


m- 


TRACED YOUR CALL. 
They haven't stepred on anv sidewall cracks since then, J hear. 


E°ll send seme more serious stuff either late tenant or tamerrnw, 


Meat mre 


RECEIF 


Sunt A PROBLEM WITH GUAR COMMINICATION 
Hellas 


As you know, IT sent vou a messase a few days age explaining why our 
communications had been temporarily cut oft. In that message [ told vou 
that I was usines a se-between who later turned out te be an FRI intormant. 
I also made reference ta the fact that I was being harassed and that I 
believed this informant was at Teast partly respansitie, 


Recently a messase from this person was ferwarded to me. In rt, he 
vehementy denied these possibilities. Now then, since I have been careful 
not to talk with anvone else concernina this, I can only assume that he 


somehow read my messase. 


There are a few possibilities here. One is that the FRI is monitoring 
your syatem without vour knowledge, in which case I feel an obligation to 


. Fiu7 


tel} vou about it. Anoth possibility is that they monitoring my 
which doesn’t involve vou ali. Or eerhars you’re Wiowins these 
communications to them vourself. 


As I’ve said (or certainty implied) before, the latter possibility doesn’t Y 
wpset me at all. Its completely within your riahts ta share our conversations 
sith amrone vou desires it’s your system and it’s your case. Hut think of 

this: somewhere alongs the line, no matter which of these three scenarios 

18 true, the FEI is lettings one of their intermants read what's soins 

tetween us! 


Yavbe I’m aver-sensitives I thinks though, that vou should be as indisnant 
as IT am cancerminga this, That eersen is mot an FRI agent, and as far as 
I’m concerned has mo business reading our mail - he is moet the one 
Tenductiog the investisation, 


I’m really rather surprrsed at the FRI. To thausht fer sure ther'd have 
eabicies against this hind of thing. By doings thig: they re compromersine 


their cw security as well as ours - this persom 1s met ta te trusted 

with anvone! Having talked personally with ham of a number or cccaslongs 

i’ve heard a few rather interesting remarvs tes made which lead me te 
believe that he’s ma mare om the side of the FAL thar Ne 1s on mine. if 

think he’s takings evervtody fer a drive, GF courses To cauld never prove this. 


zd e¢ay 
etacudd 


zeqruperre 


Please take whatever action vou cam te see that this unauthart 
S stopped. T hav against aut eavesdnceeyhe, but ure 
it stee the sto me eno cvaur Seeiines 


| 


PLS. Did vau eet my Ft 
terminal or anything. 


Thi ian 19, 
PH. FHRA: 


Fut t THE OTHER GUY 


ume de 


think the situation 16 lees imsidicus than vou might have 
The intermediary you used is alee an svperienced hacker Car 
felieve), When he sent me a shart messase sayins that he would nat 
he Am intermedrary, IT artered tim a ela aut of the ait ge ta 
“Pear, and gave him an account om Telemail. I need all the help I 
Tan g@t, and whittle I don’t have the time ar the inclination ta piay 
ou tue against each others I can always use more information ageut 
my system and hackers. When vou told me you theuent he was an 
onformant, I told tim (electronically) that he was indeed viewed in 
this lights, and he might want to clear the air if this was net based 
in truth. Clo weuld think vou would want this cprpaertunity if vou were 
im his shoes). Berry, tf this caused you undue concerns tut To must 
admit all the possibilities vou outlined could have teen the case, 
As far as I know, the FRI is net monitoring my lines. It would be 
suite difficult technically for this to te the case. 


I told vou in a previcus message that if the information you gave me } 

was helpful, I would be happy to pass this alone te the FRI (I think f 

this cannot hurt you at all). Uniess I hear differently, I will fi 
H 


cantinue on this course. 


Please discuss this further if yeu still have concerns about our 
communications. 


P-4g 


b6 
b7c 


Command? 
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Cann WisHop & WIsHOoD 


ATTORNEYS aT Law 
534 BRoaDHOLLOW Roap-CB 179 
MELVILLE, NEW YORK i747 
RICHARD G CAHN $'6; 694-2360 
EUGENE L WISHOD 


JOSEPH wiSHOD 


SUGENE R, GaRNOSKY 


Bano FR. vAMBOL 


November 7, 1983 


bic 


Pursuant to cur cont 


ation of Friday, November 4th, I deliver 
to you on behalf of State iversity of New York at Stony_Brook, vari- 


ous material relating zo ie computer investigation anf ~*d 


which I briefly cutlined te you by telephone. 


I would be obliged if, pursuant to our understanding, you would 
identify yourself to my secretary as Special Agent of the FBI and 
acknowledge receipt of these materials on the attached xeroxed copy 
of this letter. 


Sincerely yours, 


JT Fo 


RCC:bp 
Enc. 
HAND DELIVERED 


THE ABOVE MATERIAL WAS RECEIVED 
THIS 7th DAY OF NOVEMBER, 1983 
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On. 15794 


Stor 
tetepirone: (816) 246-6000 


FBI Search cf WUSB Offices 


Date: Octeber 14, 1933 


to your request, I shali attempt to provide you with a 
usmary of the events of October 13, 1983. 


At approximately 1 P.M., I received a phone call from 


informing me that there were several FBI agents on campus and presently were 
in the process of 5 room 242 of the Student Union Euilding vnich was 
2 tudio of St. He said they had arrived on the campus 2 couple 
° i Tederal search warrant. 


2€ficer, to accompany the 
the President's Office as vweli as 


office and requested a cory of 
tad es search to 

that was i 
to contacr 


was there to no avail. 


TOT tuck 


WOK at the Seeiaase 


that there are only four members 


He told y use 4 Heathzit 89 compute for the purpcse of 
‘ai i List ing of addresses, etc. I asked if they had cone any 
ED! computer or hocking inte outside computers, since the 
warrant indicated that the evidence the FBI was seeking was with regard to 
wire fraud. told me that at times they had made comnectiens with 


"comcuter bulTetin Prarés". I understand these bulletin hoards are opers 
aputer hokbyist and are used for leaving messages for private feos 
oz retrieving technical ....2maatien, etc. te said the bulletin board phone 
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ice of Vive President ur Aguunistteat 
mtuic Univer dty of Now York ot Stes Kroes 


bé 
b7c 


b6 
BIC 


b6 
b7C 


be 
b7c 


bE 
b7C 


be 
b7c 


October 14, 1693 
Page 2 


nurhers are available in computer literature. 


me thet the agents advised him 
was to be taken to New York City. 


Upon return to my office, I called University Counsel's Offices 
y and advised t: th 


m of the situation. I have forwarded to them a 
he Search warrants aS wall as the receipt for equipment. 


On the morning of October 14th, Imet with[ _—idjand—_—sdsi 
ces ibe the incident as follows: 


At about 


he was called by aad 
that the Fal to search room 243, 


see identification sinc the agents did not offer credentials 


The agerts then searched room 248, finding nothing 
r relate offered the information + i 


ut it was housed in room | 227. 


th “tne “guthority to enter an 
2 the egents es did 
class and hed a meeting returning to the 


softwar 


we with the owner of the egui 
uid do wall to seek legal advice. 


time this search was_ecccurring on cenpus 


y roormacé, 
cor puter or and software were removed frcm the 
Ter 32 a ime. did not inguire of ef his 
premises t that ti d ei ir gh 


but merely told hin to seek legal edvice. Suosequent to my 


I advised both of the new turn the situation had taxen in that 
ronerty was not that of the University. LT fete that 
hat was the case, we were still peripherally involved since 
fices sHich they searched. 
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b7c 


bé 
b7c 


FBI Search of WUS3 Offices 
Octroher 14, 1933 
Paze 3 


CL dnaa suggested, prior to learning that the equipment was 
privately owed, that| Jeelepnene the FBI and request that the 


equipment be returned to the campus and/or we get copies of everything they 
took. I ferwarded this suggestion to who said he would act on 
it. 


expressed concern, as dial} that neither my office 
nor University Counsel's Office was contacted by Public Safety when the 
agents first dame on campus but only told several hours later. 


laiso expressed the concern that he had no priar knowledge 
of the agents arrival. He felt that a phone call from Public Safety prior 
to the agents coming into the Student Union would have eased his situacicen 
greatly. 


be more concerned with protecting che University 
yj the law enforsetent giants of the Fel 


thac he felt they 
rather than assisti 


Mijke 
att. (2) 
1. Search warrant 
2. Receiot of items taken 
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to:[ 


Date: October 17, 1983 
Re: Computer search by the F.B.I. 


2. mnie ate 
> ial Se2y2n 


At approximately 11:39 a.m. on Thursday October 13, 1983, while -in my 
office (Stony Brook Union 271), I received an intercom message tromL_] bé 


(that he was in the studio (Union 240) bre 


and there were agents from the FBI with him and I should come right down. 


I walked into the studio and immediately identified-myself to one of the 
agents (it wasn't until about 20 minutes Later that I realized the agents 
had not identified themselves to me so I asked one to do which he did). 
They were accompanied by a member of the SUSB Office of Public Safety who 


you later identified to me asL_—=idfsp 2). bE 
b7G 


Upon my arrival, they showed me a search warrant for computer related equip 
ment and miscellaneous documents which they believed were located at the 
radio station (Union 249). I immediately became concerned over the fact tha 
I was certainly aware of computer equipment located on “radio station” 
eremises but net in room 240, After a few minutes of the agents searching 
the first of several rooms in our studio complex, I decided that in order 
to prevent possible disruption, interference or tampering with present or 
future broadcast studio operations I would advise the chief agent... =i 
that the station aid have access to computer equipment which was located in 
another room of the Stony Brook Union. This equioment is personally owned 
byl ™~—‘“CC tt’ WUSB, and is used by the radio station 
to create ‘and generate program logs, mailing lists and word orccessing docu 


be 
b7Cc 


At this time, ——S——=sdi began placing a series of phene calls in order to 
get permission to search room 227. At the same time he asked me if I had 
authorization to enter room 227 and would I sign a statement stating such, 


which I dia. At approximately 12:40p.m., the agents moved to room 227 (I 
WUSB8—FM, State University af New Yor'’s, Stany Stave, New Tork 1724 
Phone: Office (515) 2 


ments. 


FHA), Studios 247-7508 


- don't know if vice one authorization to do so had been reached). 
At this time, the agents entered room 227 which I had now opened 
for them and one of them immediately began photographing the con- 
tents of the room. Since I had to go teach my THR 279 class in the 
Fine Arts Building from 12:45-2p.m., I left the agents in the presence 
Sd ee | a station staff member and former[S—~—SSCSY b6é 
L___ Jana now an alumnus of Stony Brook. Eric is authorized to have 7° 
key access to room 227 as well as having knowledgé of what ccomputer 
equipment was in the room and could verify the "checklist" of equipment 


removed. 


At the conclusion of my class, I went directly to the office ofl 


‘ é ra og b6 


the situation, 


At our 9:30a.m. meeting on Monday Oeto’sex 17th, I advised you that ee 


Lidia come to me with information possibly pertinent to b7C 


to the situation. In a later telephone conversation you suggested that 
you would schedule a meeting with him and other campus officials. 
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xxx 8242 


Octeber 19, 1983 


Oifice of University Counsel 
State University of New York 
State University Plaza 
Albany, HY 12246 


- Re: FBI Computer Search 
Dear[_ +} 
Enclosed please find a copy ofL_———C*d count. of the events of 
October 13, 1983, as well as a mention of his conversation with 
which occurred in Port Jeffersen on October 15, 1983. 
Cn October 18, 1933, at approximately 2 P.M., 
Officer, and I met with] lconcerming additional information, 


which he had conveved to 


[Js a fell-time student at Expire State Oollece and is takin 


ore course on ovr carpus. He is! at WUSB. 
stated to us that when the FRI agents arrived, “theught it necessary 
to advise of their presence, in that_he kcew they were 


ard though was the 
owner, Ea said he telechened it hame shortly after the agents 
arrived cn the scere, aml respanded, "Thanks aloifor letting me 
know, there are things we have to) cet rid of." words to that 
effect.) In additicn,[ _|tald us that] is a telephone 
buff, as it were, and is very knowledceable about technical aspects of 
the telephone arnid_all of its various renificatior He also stated that 
at one tize, te. was present ween[ and a couple of 
ether young men were aperently making a telechone call to the Defense 
Department in Washington. He stated that although he has no technical 
kKrovledge of the commuter, he was preset when ha thoucht that 

end were apparently gaining access to sam@ computer 
cutside the University, though he did not know what or where at the time. 


interested in the computer equi; 


also noted that. several times during the summer, he heard 
comment about fear of the “phone police” arriving, and 
that he inferred fran these comments that they were doing something 
illegal with the telephones. 


Cree eit Shumus of Stony Brock and was involved in a similar 
Inc: comceming the commuter at Catholic University of America in 
Washington. I am enclosing the recorés, which we have on that case for 
your information and files. 
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At the present time, we are:attempti to find cut if the telechone Lines 
Univac. 


on campus were used illegally or for the purpose of accessing cur own 


If. that investigation yields. any fruit, I will keep you advised. 


7 Very truly yours, 


~ 7 I ~ 
- va -- . oe H 
_ STATE UNIVERSITY OF NEW YORK : 
AT STONY EROOK, NEW YORK t 
~ . Memorandum 


wee eeeeeee Appropriate action - 


: rere we Comment and criticism ” . : mo, 


-Your informetion’ and’ files 


-Pleasé not 


b7C ~ 


. we ee i ce ; 


° STATE UNIVERSITY OF NEW YORK 
- AT STONY BROOK, NEW YORK 


Memorandum 


be 
b7¢c 


, : 
. ot Appropriate action. _ . 
sr Someent and criticism 


formation and files 


see eeeeeeee Please note and return, = 


rn At your request... |} . . 


see eee pees 
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July 21, 1982 


TC WHOM IT MAY CONCERN: 


et the user had to enter 

els to do any sert 
he was only able to 
them. Catholic Universit 
into the system could ser 


The following is a concise account of my Gealings with the computer 
at the Catholic University of America and the events which led up to it. 
eer arch of this year, a video 
lend mine. & was purchased wi 
sim with homework in a course he 
ated eventually using it for recor 
vacic station which we beth work 
& for a time-in-our technical office. 
wanted to find out as much as we could about the different types 
ems evaileble so that when the time finally came to start entering 
a (which would be record titles and companies), we wovidn's, in effect, 
wbling in the dark. We found out about a local computer bulletin 
located in Centereach, called Connection-80- Wheat @ computer 
in board Goes is List the eccess n of computers all er 
y where one can either leave messages other callers or chtain 
ation about various computers. 
he access number for the computer at Catt versity Listed 
s bulletin hoard and probably on many ot rust § thet there 
hing underhanded ebout this particular nce che er was 
to is bulletin board by the computer tholic University. 
This is what we d bsolutely no evil 
dialed into their system te ectain i rmmation 
obtain by their h umber available. 
i r er, I vecorniz it 
u sonoolt. I ren ered 
few commands and one of ich would allow the 
tantly send me ar, I soon realized 
was a major the two systems. he one which 
in the past was unable to send messaces unless user oaged 


Orin yo HH 
7 


+ 2 “responded, s 
Li ith theic requests. A_cou 
person whose first name was 
except that it had one syllable, 
because he asked 
» my major, the secheol I went to, the 
ation, ané@ all sorts of other information 
ving him. At’ one point he asked for my no 
ich is wnere I drew the line. I did, h 
rc 

a 


ast 
7) 


the computer at Stony Brook, perhass fo 

n't see what harm he could do witWE passwor 
sother vdoint, he suggested (since he knew that 
s-radio station) that I trade him recorés fer 
evste' At the time I took this a D 
. a Fi6> : 


wok ety 
20 be 


,en resoonded. 
I talked to this same person the next evening (I don't remember the 
enact date except that it was sometime in hn) and possiblt the evening 


ex that as well, which would have been the last time I called up thei 
"stem. On each occasion he asked me suestions about myself and wh 
d. I asked him a few questions as well, however, in 811 honesty 
s answers in a matter of hours, since I had st htly more impo 
momy mind. Unfortunately, we don’t have a er 
had with this individual were lost as soon es 


:e 
sersity 
iad offered 
a I wouldnt+ 
im ttle about 
I caf ant have @ great desire to expand that ledge, excect 
° ov ind of a system would be good for our reco a talogues. 
exper n high sehocl was minimal, 
. if on’t understand what hes been going on since I com 
fith thi sidual. In early May I heard from the office of our 
*residen student Affairs. They told me that they had a complain 
tatholic rsity ZEEE which concerned me. When I first hearé this, Zz 
‘2S extr that 2 harm in my f 
‘ath rands paranoid. 
Since become more aware of the facts involved. I 
spone fore mentioned vice president es well as the canpus 
ialiso what they have told me, Catholic University ha 
woles omeone has been communicating with users atten 
tain er secre’ information. Perhaps this is 
al; I ith the espionage dramas that I‘ve been 
2 the puter room. What is unusual (at least, 
cular name has surfaced 2 one trying 
is . As I mentioned re, I heve no 
thincs, did, I7don’t have the time to deve 
> be happening is that some inconsi 
° yy the Catholic Un niversity of its computer service s 
2 the process. {Ie's obvious he/she wouldn't use th 
h case the person nad previously found out all sorts 
bene) ™ ra ad ba more convincing. ‘well, ¢& re 
een th ies of the conversations that cccurred, but I’m . 
nocked to see someone use my name and personal information 
c rip someone else off. Shocked anda Little scared. Not 
I want to’ see this stopped and if we can prosecute the 
reat, but I really Goubt we can do this unless we start tappi 
2: som In <, what I would suggest to the Cath 
$s to up their security a little, so that it's not so easy = 
2 con with users. And if anyone in the future is found to be 
von ny form, I want to be notified Cirectly. Thank vou. 


bé 
b7c 


wizic University of New York st “Stony ‘Broo 
6: Island, NY 11794 


Stony Brook é : telephone: (516) 246-7000 


June 24, 1981 


Computer Center 
The Catholic University of America ‘ : b6 
Washington, D. C. 20064 RIG 


Dear[ 3 


Following receipt of your May Ist letter and the attached records onf | 
baa teraction with Catholic University's computer, we have consultel bé 
with legal counsel and with our campus Computer Center. We have concluded that nic 
[— Jections at this end do deserve limited action under our campus 
judiciary code, but do not deserve criminal proceedings instituted by Stony Brook. 


The University's legal counsel suggests that there may indeed have been a 
criminal offense directed toward Catholic University through theft of time on 
your computer. However, our counsel further states that Catholic University 
should be the party raking a determination cn whether criminal ‘proceedings should 
- instituted in this case. 


reviewed the materi- 
al you forwarded with members of his staff. He noted that there was interaction 
initiated by but he also noted that that interaction was available 
through straight telephone access and that none of the reported conversations in- 27° 
cluded any requests to to get off the line; none of the reported conver- 
sations indicated that was bothering the users with whom he was convers- 
ing or was hampering their operations. 


We will be cot ae: unauthorized use of University services. 
We will certainly make it Clear that from our standpoint his behavior was inappro- 


priate and violated our Student Conduct Code in more than one way. b6 
b7C 


You may also wish to Know that the terminal from which’ operating. 
has been removed from the radio station. It was a personal machine belonging to 
another student. It was to have been used for developing record files. Any such 


development in future will be strictly monitored by the general manager of the 
radio station. 


fap ppreciate very much your willingness to share with us the full report of 
information that you had about inappropriate interaction with your 
computer. Please let me know 1f we can help you in any other way. | bé 
: bic 
Very truly yours 


ELW: aj 
Kies F-64 


StenySrook 


. Stony Brook, NY-11794 
telephone: (516) 246-7000 


MEMORANDUM . . 

To 

From 

Subject Investigation off s—iszd Tase b6 
b7 

Date June 18, 1981 


At your request I have purst : the matter off —_—sddiusse 


of a computer terminal in Wi. to access the computer at_Cat i 
University in Washington, D. °. I have consulted with 
es , University C outing Center, and as 


graciously reviewed case nd consulted with several members 
of his staff. has ported to me that the log of the 
transactions sent to us by C holic University does not show that 
used criminal mea: to gain access to their computer. 
In fact, the way in which th: = system is set up, they permit 
access without a password. also added that_there is no 
evidence that anyone at Cathc ic University ordered[ fe 
get off the computer or in ar: way indicated he was bothering them 
or hampering theixr_overations From perspective, we 
should focus on c.nauthorized use of University tele- 


' é* of the Vice President for Student Affairs 
te University of New York at Stony Brook 


Cc 


be 
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phone lines; his questionable .ffer to trade property, which perhaps 


@id not belong to him, to gain access to another system; and his 


foolish interference with come.:ter operations at another university. 


Based upon this review, I feel thatt Od should ke 
the University Student Conduct Code and receive a letter 
and disciplinary probation from the University Hearing Of 
believe that this matter does not warrant further acticn. 


If you require additional information, please see me. 


‘SRT/ip 


be 


Stony Brook, NY 11794 
telephone: (546) 246-7000 


MEMORANDUM - 


To rus i rc 


Dute June 18, 1981 


I wish to thank_you very much for your help in the investication 
related to the[ ease. Your review of 
transactions has been very helpful and has enabled the University 


te determine how to proceed in this matter. 


Thank you again for your cooperation. 


SRT/ip 


BSLE 


Maes 


be 
b7¢c 


b6 
bIC 


b7C 


5 e- 
“5 
State University of New York 


State University Plaza 
Albany, New York 12246 


Office of the University Counsel fw 
and Vice Chancellor for Legal Affairs 


(518) 473-7891 , 


Administration 355 
tate University of New York 
Stony Brook, New York 11794 


bear[____} 


I have reviewed the materials which you submitted in rela- 
tion to Catholic University of America's complaints about ettempts 
at unauthorized computer access made by an individual identifying 
himself as[|_ sat WUSB. b6 
. b7C 
Although the facts present a rather unique case, I concur 
with analysis that the Rules of Student Conduct may be 
implemented in student disciplinary proceedines on campus. Since 
there is no specific category in the prohibited conduct section 
of the Code covering misuse of University telephone lines for the 
Purpose of securing illegal computer access, I suggest that the 
alleged misconduct falls within the general sections relating to 
"Respect and Protection for Persons and Property" (Section A-1l) and 
the "Integrity of Transactions and Records" (Section A- 


More specifically, these sections provide that: 


"A(1) (b) No student shall take, possess or 
damage any property not his/her own on the 
University campus or on any University 
property.” 

and 


"2(3) (d) No student shall knowingly take or” 
use any services without authorization." 


There may be other sections which you feel are more appropri- 


ately utilized than these cited. In any event, I see no jurisdic- 
tional difficulty. 
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June 3, 1981] 
Page Two b7C 


If I can be of further assistance, please feél free to 
contact me. 


b6 
b7C 


b7c 
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@ CauN WISHOD & Wise 


ATTORNEYS aT Law 
534 Broapnotitow Roap 
MELVILLE, New YoRK 1747 


mowaRD Cc. cAMN +(516) 064-2300 
euoeNe LW sHOD 
YOSEPH M.wisHOD 


DOUGLAS A. MENALLY 


May 29, 1981 


bé 
b7C 
aministration = 


SUNY at Stony Brook © 
Stony Brook, NY 11794 


CONFESENT EAL 
. bé 
Dear[_ BIC 
I have reviewed the file onl S—sidand I believe that there 
was a criminal offense which probably in the last analysis will be 
determined to heave occurred in both the State of New York and the 
District of Columbia. However, the victim of the theft, Catholic 


University of America, should really be the party making a determina- 
tion where criminal proceedings should be instituted, if at all. 


With respect to any student disciplinary proceedings on campus, 
I would assume something in the Rules of Student Conduct would cover 
a Stony Brook student utilizing the University telephone lines for 
the purpose of making long distance calls and securing illegal 
access to another wiversity's computer. You should, therefore, con- - 
sider whether as a matter of policy you desire to institute such 
Student Conduct Code proceedings against the student. ae 


ceemererseeseell Counsel's office has expressed a strong interest 
in is matter and I am, therefore, this date forwarding to her all 
of the macerials which were just received from you together with the 


copy of this letter. 


Sincerel ours 


- b6 
b7c 


F-69 


“fo. 


3. LE. 8! 


ft 


Dea er | 


THE 
CATHOUC UNIVERSTY 
OF AMERICA 


WASHINGTON D.C. 20064 


COMPUTER CENTER 
202 035-8373 


May 1, 1981 


ane z - = 


State University of New York at Stony Brook . 
Stony Brook, NY 11794 bé 


b7C 


As I promised in our phone conversation Thursday, 
April 30, 1981, enclosed are copies of the pertinent dialog 


between three different CUA computer users and someone who has 
been accessing our DECsystem-10 claiming to a an 
[et SUNY/Stony Brook and an employee of Radio b6 
Station WUSB. In the printouts, dialog beginning with b7c 
“;;TTY56" is from the "phantom" caller, and dialog beginning 

with "SEND TTY56 ..." is from our user. (The number of the 
terminal, TTY56 above, may vary--this is because he was 

dialing into the system and getting a different line each 

time.) In most cases, his messages appear in lower case 
characters and our user’s appear in upper case only. 


The problem was first brought to my attention Thursday, 
April 23, 1981, when one of our part-time programmers gave me 
a printout (see Item 1} of a dialog between himself and 
someone who claimed to be named Eric who was offering to trade 
record albums for an access code to our system. The caller 
claimed to be working for WUSB and using a terminal located in 
the station. He told of ex ging five record_albums with b6 
one of our students named in exchange for access 7c 
code to our system. When we checked the code he had been 
using, we found that it had not been issued to anyone named 

We did talk to the person to whom the account was 

issued and are fairly certain that he was a victim of someone 
on our campus using his access code. . 


. Friday, April 24, 1981, a graduate student brought me a 
printout (see Item 2), again of a dialog with this time 
offering to trade access to long-distance telephone lines in 
exchange for a system access code. The caller gave our user a 
local phone number to call, two access codes for the 
communications system and instructions on how to use then. 


- sh us heel Fach bu :a/fes eocteb edie 
py hehe besn bre 
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2. DE ay 2, ten, gy. Page 2 PS 


At this time, I talked with a representative of C & P 

Telephone Company. After a check, he told me that the lines 
being used were not Bell Telephone lines, and therefore, they 
were not interested in the problem. I next talked to a 

an investigator for MCI Communications. be 
‘Re was most interested and most concerned about this activity. pyc 
He subsequently checked, however, and found out that the 
access scheme was not MCI, but was one belonging to Southern 
Pacific Communications. I talked withL 
Spc. He told me that the long-distance access codes belonged 
to two California firms, and that they would begin to monitor 
the usage of the two codes. I sent him copies of some of the 
pertinent printouts. 


called me Thursday, after I spoke with you, 
to tell me that he had somehow examined the account activit 
_for March for the two access codes and learned tnat> 


- L___|rea made several calls using these codes. He also told b6 
me that he had talked with of SUNY/Stony bic 
Brook and had confirmed that was a student there. 


He indicated that no action had been taken. JI gave him your 
name and phone number. I assume he has since contacted you. 


Both firms expressed that while they are concerned about 
illicit usage of their phone lines by a person claiming to be 
a student, they are most concerned about the damage that could 
be done if the numbers were given to a “professional” who 
fully understood their usefulness. 


Meanwhile, our Systems Programmer began taking steps to 
temporarily limit what’a user could do on our system without 
having an access code. This patch was in use over the 
weekend, so we do not know what, if any, access this person 
tried to obtain. However, the patch had to be removed Monday 
morning and a more permanent fix applied. This was not 
accomplished until Thursday morning. 


This person was again on the system Tuesdey night. Both 
the user who "talked" to him last Thursday and our Night 
Operations Shift Supervisor engaged him in dialog over the 


system. Printouts from both dialogs are included. Our user 

this time managed to extract the last name ofl ae ieee be 
Item 3) and also that bh Csystem— white he was b7C 
a student at Our Operator did not 


» Jearn anything which we did not already know. . 


In addition to the events we can document with printouts, 
I have had numerous students, faculty and even staff members 
of the Computer Center tell me that they had at one point 
received unsolicited messages from this person. Unsolicited 
messages serve only to interrupt someones work and to distract 
them from what they are doing. In the case of one user, he 
had to reprint several pages of a document because a “garbage” 
message was in the middle of it. 
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The person calling neicens | = eal hee twice given 
our people the phone number of WUSB. now of one occasion bé 
when our user actually called the number, asked for and bIC 
actually spoke with someone claiming to be 


‘Of more serious import, Tuesday night during the dialog 
with our Operator, the caller gave him the phone number (see 
Item 4} to access your Univac computer system. I am sure that 
my counterparts in your Computer Center would be most 
interested in this. 

We would like’ to see this activity stopped. As I have 
indicated, we have taken steps to tighten our own system 
security. 


Clearly, this may be a situation in which the caller does 

not realize the seriousness of his actions. However, we 

- estimate that we have spent over. $1,000 in staff& time alone 
dealing with this problem. We view this as harassment of our 
employees and our users. This activity, from our 
understanding, is a Federal offense if the calls are coming 
across state lines from New York to Washington, BD. Cc. In 
addition, this person has admitted using SPC lines without 
authorization which is probably also a violation of statutes. 


We appreciate your taking action on this problem. Pleese 
feel free to contact me if I may be of further assistance. I 
would appreciate your letting me know the outcome of this 
situation. Ara 


= Sincerely, 


bE COCC~—CSS ” 


AAR met 


Enclosures 
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Communications Management ongineenng 
r je President for Administration 

South Campus Building A, Room 142 

State University of New York at Stony Brook 

Stony Brook, New York 11794 

telephone: (516) 246-3500 


StonyBreok 


MEMORANDUM 


rv —— 
bb 


Subject WUSB Telephone sony 


Date October 26, 1983 


Attached is a listing of all telephone lines leased to WUSB Radio 
Station. The list is broken down into two categories, the first pert consists 
of 6 telephone lines, only one of which is capable of reaching long distance 
(7122). Also attached is the billing for this phone from May, 1983 through 
September, 1983. The remainder of the phones cannot reach long distance, 
however, the two phones with A2N service can reach all of New York State and 
Washington, D. C. and vicinity. Unfortunately, our antiquated Centrex phone 
system is not able to identify calls made on these tie lines. 


The second part of the list labelled radio circuits are used through- 
out the campus to interconnect various locations such as the Gym back to the 
studios to broadcast sporting events. 


The potential for a bright technical oriented person such as the 
involved parties is to connect anyone of these radio circuits to any phone 
circuit on campus in the many Telco closets scattered throughout the campus. 
In effect this would rean they would be able to make calls from the sniio via 
these circuits cn anyone's phone line which in most cases goes umetect: 
because very few department heads question their telephone bills cn a thorough 
basis. 


The Message Unit Detail (MUD) reports which I promised are still being 
processed by the phone company and should be available in about 1 week. This 
will give you all local calls made on these phones in the 516 calling area for 
approximately 6 months. 


If there are any questions that may surface regarding the attached, 
please call me. 


Attachments 
Me 
. DM: pvo be 


ost - bye 


Closed Circuit TV # # @ Radice « @ Telephones # @ @ Security Alarms 
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Federal Bureau of Investigation 
ATTN: 

300 Lee Street Room 500 
Alexandria, VA 22314 


bé6 
ce b7c 
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Federal Bureau of Investt; 
300. North Lee Street #500: 
Alexandria, VA 22314 


You called the other day to- ask about: 
I told you then, I have received: phone 
again asking for this person, 


couldn't find a box for it otherwise. T Hase-® say 
looking for him, its the first time a letter was addressed 
The address is not even correct, we don't have a number such‘as B-16, 


If its of any help you are welcome to it. There is no return address shown 
to send it back to and I refuse to get involved any further by reading it 
or learning more about Roger. The less I know the better I feel. If 
anything further comes to my attention I will advise you. 


b7c 
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January, 1984! 


Duntened moninie by 20000 ES LER PRENES, an cheemeevnary organieation, Suberiptcon 
rates are $10 sonuath Werte tor IANO, Hoe 752. Muddle lend. NY 11053 


*o#D VOLUME ONE, NUMBER ONE 


AHOY! 


(That's how Alexander Graham Bell used to answer his phone. For some reason, it never caught on...) 


This is the very first issue of 2600, We will, on this 
page. explain our motives and what the goals are 
which we hope to achieve with this publication 

The idea for 2600 was born earty in 1983. Wesawa 
tremendous’ need for some form of communication 
between those who truly apprectate the concept of 
communication: technotogicat enthusiasts. Of course. 
others have different ways of describing such people — 
these range from words like hacker or phreaxer to 
stronger terms such as criminal or anarchist. Our 
Purpose is not to pass judgement. 26/7) exists to 
provide information and ideas to individuals wno hve 
for both. Allof the items contained on these pages are 
provided for informational purposes only. 2600 
assumes no responsibility for any uses which this 
information may be put to. 

Of course. a lot has changed since our first davs 
War Games came out. And then the 4I4 gang got 
caught. Suddenly evervone was talking about 
phreakers and hackers. And while there were some 
that sort of jumped into the limelight, others were a dit 
more cautious, in fact, some were quite upset. Sure. 
the publicity was fun. But what would be the cost’? 

Weil. time has passed and the cost has been high. 
Phreakers and hackers have been forced into virtual 
isolation. Ratds by the FBE have become aimost 
commonplace.. The one magazine that was geared 
tuwards phone phreaks (74) aivsteriously disan- 
peared at the height of the crisis, sparking rumours 
that they, too, had been raided. However. in 
November, the magazine resurfaced, with an 
explanation that a fire nad destroved part of their 
mathng list. (incidentally. if your name was one of the 
ones that was lost. you can ctaum the issues you are 
entitled to by sending T4P a copy of their mailing 
label or a cancelled check.) 

And then there was the legendary computer bulletin 
board known as OSE NY. Enthusiasts from all across 
the country called up this board and teft: messages 
ranging from the latest in Sprint codes to how to crash 
an RSTS system to what to do once you've finalty 
gained access to Autovon. Within a week after being 
mentioned in Newsweek, OSCN Y was disconnected 
Word has it that they are still in existence somewhere, 
but by invitation only. A truly smart move, df that is 
the case. 

Many hackers were keeping a low profile even 
before the October raids. When the FBI confiscated 
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equipment from {5 sites across the country on the 
twelfth and thirteenth of the month (sponsored by a 
gtani froma che folks at STE} many of our contac 
were lost because they feared the consequences of 
continuing. Two organizations, the inner Circle and 
PHALSE, were deeply affected by the raids. The Jatter 
group (whose imtials signify Phreakers, Hackers. and 
Laundromat Service Empioveessis stuilin contact with 
us on occasion und has promised to contrioule many 
articles devoted to just what was reaily going oa. 

So it seems that the events of i963 Gave conspired to 
actually vrenginen Che resolve ot sackers: dng 
phreakers across the country to put tut (nis monthly 
newsletter, We hope you will Acip us sontnue oy 
subscribing, spreading the word among your Irend: 
and of course contriputng ar! Suna information 
Since we are non-promit. it really doesn’: matter to us if 
vou xerox your copy and send ul £0 someone eise —ail 
we ask 1s that you let us know so tnat we can have a 
rough idea of how many peopie we're reacning. 

2600 has several! sections. some of wich will appear 
every month. others on an irreguiar basis. On this. the 
front page. and on page two. you will always find 
informauve full-length features oa reievant sublects. 
Future topics inciude: “A Guide to Long Disiance 
Telephone Services und The Vulnerabrities, “DEC 
ang Ther Many Mistakes” *Phrestkin aothe 
and “Tracing Methods Used b» the Law” as 
wellas any late-breaking items. “FLASH” appears on 
page Sand provides a roundup of timely news items 
written from a technological entnusiast’s perspective 
Page 4 1s used for a variety of thinus -interesting 
stories from the past, schemes and plots that just might 
work. and feedback from subscribers. The last two 
pages of 2600 are comprised of data. Just what sort of 
data, we cannot say. However. if it ts something that 
you are looking for, then you will peohably recognize 
it 

The three holes on each page serve a purpose. We 
suggest that vou obtara a loose-ival book so that you 
can neatly (le every issue of 2600 you receive. 

Many thanks to those of vou who subscribed 
without even seem un issue, A word of advice. 
though: dant do it again or you'll probably get ripped. 
olf We'd also like to thank those whe took advantage 
obour tree issue offer. If interested in subscribing. the 
rates and address can be found at the op of tts page. 

Welcome to 2600, arn the page aad become a part 
of var unique world 


FBI GOES &FTER ADSS1ACKERS 


IBM must press charges before action can be taken — Feds reveal their tactics, blow source 


On this page we had originally planned to run an 
arucie entitled: ESS — Orwell's Prophecy. At the last 
minute, however, we received this bombshell fromean 
anonymous contributor. It seems that a group of 
hackers was making use of one of IBM’s ADS sys- 
tems, (Audio Distribution Systems enabie users with 
touch-tone phones to send voice messages back and 
forth to each other. Look for an in-depth article on 
them ina future issue.) Unfortunately, as 1s all too 
often the case. one of these hackers was really an 
FBI informant who was taking note of all of the 
ulegitimate users faround 40 or so). Luckily for 
this particular group, the informant was sloppy and 
left many telltale clues which gave them literally 
months of warning, So, when the informant de- 
cided to send a message to the system operator, 
cdusing [BM to take action against the hackers 
and to call the FBI for more information, the 
hackers were ready. The system operator's account 
had aiso been penetrated by them and hence, the 
message was received by the hackers first! One of 
them actually followed the instructions in the 
message and called the FBI! And for some reason, 
the investigator there ‘thought ke was talking to 
an IBM executive. This is some of what he said. 


One of the individuals that supplies me with in- 
formation from time to time has uncovered a lot of 
abuse within the ADS systems, not only here in the 
United States. but in England and Italy. I talk to 
this individual on a private bulletin board. . . 

We have no ability to come in as an outside in- 
vestigative or iaw enforcement agency and do any- 
thing about it because. first off, we don’t have a 
complainant. We don't want to step on anybody’s 
toes, but it’s been our policy to monitor bulletin 
boards and the phone phreaking activity across the 
country and advise commercial computer systems and 
corporations if we do discover certain computers 
along with the passwords and account numbers being 
publisned on the board. We do this on a one on one 
basis. 

The GTE Telemail Connection 

That was my baby, too! Asa matter of fact, that’s 
how we came across the ADS system — through the 
GTE investigation. [These] people are not just in- 
terested in data communications through terminals — 
they will leave voice messages on an ADS. We have 
been slowly uncovering more and more on the ADS 
in the iast two months, 

The major phase of [the Telemail investigation] 
was about 20 individuals that we had located and 
identified and we're looking for indictments on most 
of them coming down in the next month or two. 
We're talking about a group of highly organized 
people that do communicate on a daily basis all the 
way across the country — from San Francisco and 


L.A. to Denver ta upstate New York. So we havea 
core of individuals that we are still looking at that 
are using your system and then we have this peri- 
pheral that we are not as concerned about because 
‘they are not part of an out & out conspiracy or an 
Organized network, per se. | know of at least 8 or 10 
that are the central figures in this, the carryover 
from Telemail. And we keep hearing information of 
other people who are cailing in with junk messages — 
there’s no real substance to their messages. Now the 
reason [ know that is that they have included one of 
my sources of information onto their system and so 
he gets messages from the other parties. 


The Communist Connection 

In a way we're somewhat fortunate that it’s 16- 
year-olds or 26-year-olds as opposed to people from 
behind the fron Curtain. It gives us the opportunity 
to see how these systems work and see if we can plug 
any loopholes before somebody from a not-friendly 
nation would try the same‘thing. [ personaily fully 
expect it — i'm surprised it hasn't happened in the 
past. It may have. We just haven't caught it. But the 
kids are a little bit sloppier and they're getting 
caught. .. [ hate to sound paranoid. but we're sup- 
posed to be considering the big picture as [ar as is 
there anything sensitive in nature. Por us within the 
bureau, sensitive in nature first off means national 
security and you’ve got corporate trade secrets and 
the like that you don’t need being distributed. 


How the FBI Wins Trust and Gets Info 
The subjects have an ego problem and thev love to 
talk to other individuals about what they are capable 
of doing and bragging about it. They have a tendency 
to trade information. Everything is negouiable with 
them. We have never had to barter away access to 
systems — we do it more on the technical information 
of phone networks, computer systems. and the like 
to where it’s more of a technical information tradeoff 
as opposed to an access tradeoff. {An example would 
be the} login procedure for a PDP-11. You integrate 
yourself within their confidence and their circle of 
friends. You feed them a little bit of bait and a lot 
of times they'll go for it. You enter into a dialogue 
with them and they end up taking you for a ride. 
These people are very hungry for technical avenues 
through which they can communicate. [t used to be 
the personal computer bulletin boards — public 
messages that anybody can read. You start finding 
out that they leave a phone number or an address — 
and you start finding out who the parties are. There's 
thousands of these bulletin boards across the country 
and you narrow in on maybe twenty or so that are 
the more hardcore bulletin boards that are being used 
for exchange of illicit information. Then they move 
from there to an electronic mail service. namely GTE 
Continued on back pare) 
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GTE raids still have many unanswered 
questions—computer owners concerned 


Compmed News Sources 

On Wednesday, October 12, at 6:00 AM. ihe FBI started 
to raid the homes of over fifteen individuals for allegedly 
breaking into Telemail, GTE Telenet’s massive electronic 
mail service. While much of the publicity has now died 
down, questions remain concerning the legality and the 
overall implications of such computer seizures. 

Ata December !6 meeting of the Long Island Computer 
Association, this topic was addressed. Some members could 
not understand the rationale for taking away the computers 
in the first place. “!t sounds like scare tactics to me... to keep 
these kids oft of computers,” one commented. “To hold the 
equipment seems like something that should be unlawful 
and it's something that the public should look at. If it's not 
justified. we should say that we won't put up with itanymore 
and to return the equipment.” He did not elaborate on 
precisely what kind of action a cotnputer group such as 
LICA could take. 

Legally, the computers can be kept for as long as they are 
needed in the investigauion. Ultimately, a judge will decide 
how long that can be. 

“The allegation,” said an attorney familiar with the case, 
“is that the services of the Telemail bulletin boards were used 
and the theory that the government is proceeding under is 
that it was a violation of Section 1343, wire fraud (a scheme 
with intention to defraud someone else using either 
television, telephone. or some other communications 
means), They're saying that if there was use of the bulletin 
board service, then that was a ‘theft of service’ and there was 
intention to defraud GTE.” 

One member took GTE’s side. “These are ail nice games 
these people are playing, but they are a theft of service. 
Somebody is in the business of providing that service and 
they're deliberately interfering with their providing that 
service. They're trying to get something for nothing.” 

Another disagreed. “You may be on their computer, but 
it's not costing them anything, if you're not taking up time. 
Unless the whole system is fully used and you were the last 
user on, are you really using any of their time? Really and 
truly?” 

Many hackers feit they were unjustly accused. One even 
said he'd never used the Telemail system. Others said they 
had looked around once or twice but had never hurt 
anything. Others. though, admitted to deleting mail and 
playing tricks, like sending obscene messages back and forth 
between two innocent executives. 

Whether or not the Telemail system was used fraudulently 
did not seem to be the overriding issue at the LICA meeting. 
What had members there worried was the way in which the 
investigation was being carried out. When dealing with 
computers as evidence. different rules apply, rules that for 
the most part have not been written yet. “Data can be 
manufactured just as easily as it can be erased from a 
personal computer,” one member commented. “And the 
jonger that they have the computer in their custody, the jess 
likely that the information that they claim is on it was 
actually there. Because, as we know, you could enter any 
date, any time into the computer and have it date- and time- 
stamp the files.” 


F-78 


Meanwhile. a GTE Telenet spokesperson said that the 
corporation still intends to prosecute and denied that the 
whole thing was being put on for the deterrent etfect that it 
might have on other people. The spokesperson also said that 
abuse on the system was discovered in the past. but they 
didn’t prosecute at that time. This time, though, they're 


serious. 
AT&T Credit Cards Make Debut 


2000 News Seewee 

There's now another way to place telephone calls without 
dimes. This month, the “true” AT&T credit card phones are 
making their debut in various airports around the country 
This new phone actually takes an AT&T credit card (not 
those wimpy “calling cards” or “PEN cards.” We're talking 
about a rea/ hunk of plastic. with a magnetic strip and 
everything.) — and there’s even a littie video screen that 
gives vou directions. 

Unless some sort of a bug can be found within the system 
itself, phone phreaks won't accompiisn very much here. 
uniess they can actually get their hands on other people's 
cards. This, in itseif. wouidn't be too ditficuit, since farge 
numbers of the cards would be sent out os the samedavina 
particular area. Stealing out of personai mutiboxes, thougn, 
Is an act most phone phreaks wouid never stoop to. And the 
folks at AT&T are well aware of this. 


Wireless phones spell trouble 


2600 News Service 

With cordless phones popping up alt over the place, 
problems were bound to arise. it’s not at all uncommon to 
hear another cordless conversation on your phone or to hear 
the electronic pulse-beeping when you're not even dialing. 
Then there are cordless phone phreaks to deal with, who 
drive into heavily populated zones holding one of the 
common cordless models. [t's called “cruising for 
dialtones.” And some phones are nice enuuzh to broadcast 
your conversation on an AM frequency. This feature isn't 
very good for private conversations. It helped shapea recent 
drug bust in the state of New York. 

Recently, a lady in the Midwest calied up her loca! electric 
company to tell them that she was going to be away for two 
months. A member of the 2600 Club heard this on his radio 
and, being in a good mood, called her and told her that 
important, personat business should never be discussed on 
cordless phones. After thanking him, she exclaimed, “That 
thing's going right back to the Phonecenter Store!” 


1984 arrives in Hong Kong 
The Los Angetes Times 

In an effort to “discourage people from driving their cars 
in heavily congested areas” all 350.000 of Hong Kong's 
motor vehicles will be fitted with tracking devices that will 
let government computers know exactly where each car has 
traveled so that the owner can be billed for road use. This 
system could be in full implementation by (987, if the 
government has its way. Such a system would also allow the 
police to quickly pinpoint the whereabouts of any vehicle. 
Tampering with the $45 tracking devices will be illegal and 
any attempt to do so will trigger street cameras to 
photograph the license plate of the car. 


® 
THE TRUTH BEHIND THOSE 9999 NUMBERS 


by Mark Bluebox 

Once upon a time, | was talking to one of my favorite 
friends, one of the nation’s oldest and most experienced 
telephone enthusiasts—some might refer to him as a phone 
phreak. In this particular conversation. he mentioned to me 
that | might want to experiment with a series of 800 
numbers: exchanges starting with 9. followed by the suffix 
9999 (800-9x x-9999). And so | did, and a whole new world 
began to open up in front of me. 

They were mostly weather and time numbers in various 
locations throughout the country. And, since these were $00 
numbers, there was NO CHARGE! One number in 
particular was of a great deal of interest to me and to many 
others. This was 800-957-9999, which hooked up to WWYV, 
(he radio station operated by the National Bureau of 
Standards that does nothing but tell the ume and give 
shortwave reports. This is the most accurate clock in the 
entire world! You either have to tune WWV in on a 
shortwave receiver or dial 303-499-7111 in Fort Collins, 
Colorado. Yet. here { was with an 800 access! Beinga bit ofa 
shortwave enthusiast. [| don't have to teh vou how 
convenient this was for me, Unfortunately. it got too 
convenient for tog many people. 

i guess [ made the mistake of giving « to a former 
president of a large amateur radio club in the Dailas area. 
He, in turn. printed it in the Amateur Radio Newsbulletin 


where thousands of people probably saw 1. Another 
statewide newsbullctia picked it up and printed it, Through 


an amateur radio news network which this bulletin was a 
part of, the news got as far as California. 

One day. I called up the West Link Amateur Radio News 
Service at 2£3-768-7333. (This is a service located in West 
Link, California that broadcasts news over amateur radio, 
VHF, UHF, etc.) Their iatest report had this little item: 
“Speaking of interesting things, the National Bureau of 
Standards has got a very convenient time number for those 
of vou that are not constantly at a shortwave receiver, You 
can dial 1-800-957-9999 for WWV. it's just another good 
toll-free service for us to use.” The avalanche had really 


begun now 

The West Link report was heard on bulletin stations afl 
around the world and, apparently, one station in Nashville. 
Tennessee broadcast it. From there it fell into the hands of 
one of the writers for the DX program on Radio South 
Africa! I happened to be listening to a program where they 
were talking about pulling in distant time stations, weather 
stations, etc. He then mentioned, “For those of you that live 
in the United States, a convenient toll-free 800 number has 


been provided by the National Bureau of Standards for 
WWY and that number is 1-800-957-9999." Imagine my 
surprise! Once again, the number had been broadcast all 
around the world. People in many. many nations now had 
that number. Of course, the number only worked inside the 
United States. but the word was being spread by shortwave 
listeners and QSL people everywhere. 

The number was getting swamped. Needless to say. it was 
busy much of the time. A government official, who a/so had 
this number, thinking that it was legitimate, catled up WWV 
and complained. He toid them that they needed to add some 
more lines to their new 800 number. The general manager of 
the station said. “f don’t know wat vou're talking about. | 
don't know of any 800 number that gets you WWV." 

The government official told Aim what the telephone 
number was. The general manager calied it and heard his 
own station. Astounded, he contacted the Mountain Bell 
Telephone Company in Denver, Colorado. Thev said, 
“You're not paying for any 800 in- WATS number. We show 
303-499-711 for WWV. but we don't have anv &00-957- 
9999." 

Mountain Bell checked it out and sure enough, the 
number existed but not on rheir records. No one was getting 
charged for this! Now, of course, you know a monopoly as 
wellas | do—they're sure not going to let anvone havea free 
ride. So they told the WATS coordinator to find out what 
happened. He finally made the discovery that some 
technicians had heeked that number up for transmission 
testing. [These switching technicians are toll technicians. 
AT&T Long Lines switching technicians, and carrier 
systems technicians. In other words, they're the group of 
people who link switching centers together, from New York 
to Los Angeles, for exampie. In this case, the whole 
escapade was a kind of group effort. The switchmen and the 
carrier peopte got together and set up this number for 
testing, finding noisy carriers. carriers with cross-ta!k on 
them, etc.] 

The WATS coordinator told them they'd beuer get this 
number off—too many people knew about it. He told them 
to erase every 800 test line number that was on the system 
Not surprisingly, someone also got chewed out very 
severely. 

So, consequently, 800-957-9999 is no longer in existence. 
But since then, less than two weeks jater, several of the 800 
test numbers have begun to defiantly reappear. Check 
around, you'll probably find a few interesting ones. But | 
doubt if WWY's brief stint as a toll-free service will ever be 
repeated. 


Ahoy, folks! If any of you have ever 
used an extender that goes by the name 
of 8006213129, you'd better give it a call 


now! The people 
message for you. 


running it have a 
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Position 


ame 


Office of the President 


The President 
Special assistant 
Personal secretary to 
the President 


Office of the Counselor to the President 


Counselor to the Presidem 
Deputy counselor 
Assistant counselor 
Special assistant 

Assisiant to the President 

for Cabinet affairs 
Secretary 
Assistant director 
Administrative assis- 
tanks 


Disecior of ptanning and 
evaluation 


Chief of staf 
Execulive assistant to 
the chief of staT 
Staff assistant 
Confidential secretary 
Deputy tothe chief of staf 
Administrative assis- 
dam 
Secretary 
Special assisiant ta ihe 
chef of staf 
Presidential correspon. 
dence 
Special presidential mes- 
sages 


Ocpuly chief of siaff 
Assistantio the dep 
uty chief of uaff 
Siaf assistant 
Special assistant ta the 
President for private ini 
natives 
Eaccutive assisiaal 
Oirccror of speciai seppori 
seevices 
Deputy direztar of 
special support ser 
vices 
Depuly director of 
military office 
Army aide 10 the 
President 
At Force arde ta the 
Pressdent 
Navy aide tothe Presi- 
dent 
Marsne Carps aide to 
the President 
Physicisn tothe Presi. 
dent 


Ronald Reagan 
David C, Fischer 
Kathicen Osborne 


Edwin Meese III 
James E. Jenkins 
Edwia W. Thomas Jr. 
Mitchell F. Stanley 
Craig L. Fulier 


Adela Gonzalez-Nardi 

T. Kenneth Gridb Jr, 

Karen Hart 

Naney A. (Missy) 
Hodapp 

Richard S. Beai 


Office of Chief of Staff 


James A. Baker ill 
Margaret D. Tutwiler 


Kathy Camatier 
Margaret Glasscock 


Sars Currence Emery 


Janet F. McMinn 
dames W, Cicconi 


Anne Higgins 


Dodie Livingsions 


Office of the Deputy Chief of Staff 


Michael K. Deaver 
Joseph W, Canzeri 


Shirley Moore 
Jame: 3. Rosebush 
Bernyce Fletcher 


Edward V. Hickey Jr 


Dennis E. Le Blane 


Col. Frank E Milloer 


Lt. Col Jose A. Muraiti 
Jr. 

May. Willam M 
Drennan 

Cdr. Wilham R Schmidt 


Maj John P Kline Jr 


Dr. Daniel Ruge 


2858 
2168 
2858 


Director of advance 
Deputy director of ad- 
vance 
Administrative assis- 
lant 
Trip desk officers 


Extension Positinn 


Advance sal 


Disecsar of scheduling 
Depuly director of 
scheduling 
Adminisirative assise 
tani 
Staff assistanus 


Confidential assistant 
President's dianist 
Appointments secre- 


wary 
Staff directory for tbe First 
Lady 
Nam maslPalive assis- 
ant 


Press secretary 

ASSISLATI press Secres 
lary 

Personal secretary 

Social secretary 

Assistant social secre: 
an 

Scheduling director 

Special projects 


page 5 


Name Extension 
Stephen M. Studden 7565 
Hugh L. O'Neill TSS 
CeCe B. Kremer 7365 
Mani J. Frocei 7565 
Karen Jones Robens 1565 
Lynn Smalipage 7365 
Rober K. Gubitosi 7565 
James F Kuha 7565 
Dan Morris 7565 
Lanny F. Wiles 7565 
Rocky D. Kuonen 7365 
Gregory Newell 7560 
Tricia Rodgers 7360 
Cristy Valentine 7560 
Michael Castine 7560 
Frances (Fan) Snodgrass 7560 
Netla A. Dickey 7560 
MaryH. Rawlins 7560 
Ellen Jones 7560 
Helen C. Donaidsca 186) 


er McCoy 
Christine J. Hatnaeay 


Sheila P Tate 
Barbara Cook 


Elaine Crispen 
Muffic Brandon 
Linda Fauikner 


Nina Wormset 
Ann Wroblesig 


Office of the Vice President 


The Vice President 
Executive assistant 
Chief of nal 
Denuty chief of sta 
Military assistants 


Counsel 
Deputy counses 
Press sceretary 
Deputy press secre- 
lary 
Speechwriter 
Domestic policy adviser 
Assistant domestic 
policy adviser 
National security affairs 
adviser 
Congressional relations as- 
sistant 
Legislonve assistant 
Assistant for appoiniments 
and scheduling 


George Bush 

Charles G. (Chas) Un- 
lermeyer 

Canie! 3. Murphy 

Richard N. Band 

Lu Col. Michaei D Fry 

Li. Col. William Ecacn 

C. Boyden Gray 

Rafael V. Capo 

Peter Teeley 

Shirley mM Green 


Christopher Buckley 
Thaddeus A. Garrett Jr. 
Mary S.Gall 

Nancy Bearg Dyke 
Roben ¥. Thompson 


Susan Alvarado 
Jennifer Fitzgerald 


2242424 


2248391 
7870 


Ati tele ph 
«Mere an 


ful! 


numbers ars on the £56- exchange excep thos: marked with an asterisk, which are on the 395. cacaange, ind 


Vroper tabbing is extremely important when typing a dist. Above is an example of Labs used successfully 
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This here page is usually a conation of page 5. However, whe ver a blockbuster story 
like the one below, we have to reallocate our space. We know you'll understand. By the wav, 
as long as we've got vou looking up at this part of the page, why not take the time to send us 
some mail? Letters. articles, information, old telephones, paintings, anvthing, really, You 


know the address (it’s on the front page). Let's hear from YOU. 


FBI VS. HACKERS 


(Continued from second page} 

Telemail. They caused fits within Telemail when 
they decided to get a little bit cocky and see if they 
could shut down accounts and change passwords of 
the administrators and things like that. From there 
they have moved one step further to where they are 
now the same individuals communicating through the 
ADS systems and they aiso set up conference calls 
through the Bell System, so they're not just attacking 
one particular system or one individual avenue of 
communication — they try to hit them ali. It's an 
ego trip for all of them. 


Pen Registers 

We would put a pen register on che prone: 
the individual (susp: would record or 
digits dialed on hi 1one — we would not use a 
full blown wiretap to record his voice, We can only 
put a pen register on an individual's shone for like, 
thirty days before we nave to go pack to a judge and 
try to get an extension and we try to minimize the 
use of our electronic surveillance equipment so the 
public does not think we're the Big Brother of 1984, 
(laughter) It’s coming. Actuaiiy, we're already 
there! (hearty laughter! 

We have not utilized any pen registers for the spe- 
cific purposes of going after abusers of the ADS 
systems. First off. we have to nave an actual case 
presented to us or a complaint. it’s a roundabout 
way of doing 11, but it’s the way that we, in the 
bureau, have to have somebody outside come to 
us, Otherwise we can carry on the whole investi- 
gation without [BM even being aware that we are 
monitoring activity within their system and we 
don't want to become that secret police, or any- 
thing like that. We want to be above board and work 
with the corporations in the community, 


Just How Much Trouble Are These Hackers In? 

On the federal level we can prosecute them for 
telephone fraud (fraud by wire) if we can determine 
that the ADS is an ongoing business operation and 
that you are being denied your just revenues by them 
sneaking onto your system and abusing your system. 
The strictest penalty is a $1000 fine and 4 years in 
jail for an actual conviction of fraud by wire vio- 
lation. Those are always lax — a more common 
sentence may be for an adult maybe a year in jail, 
18 months, or a fine, sometimes they get probation, 
or agree to pay back any fraudulent money obtained 


or for services rendered or whatever to the client 
company — it stays on his record for a year, he’s on 
probation for a year and at the end of that, his record 
is wiped clean. Rarely do they get the maximum 
penalty. It just doesn’t happen. 


Do Mea Favor 

Please do not disclose any geographic location be- 
cause we are kind of unique in that we do not have 
any other source available in any other part of the 
country that could supply us with information like 
this. He may be one of 200 people, but if you iden- 
tify Michigan you identify between 2 or 3 individuais 
and it may burn the source. 


Wed like to make it clear that we don't intend to 
do this kind of thing very often. since rumours ahout 
certain people being informants are very common in 
this business. But this is no rumour. This. friends, is 
solid fact — we would not have printed this story if 
we weren't able to substantiate the claims it mares, 
and we had no trouble at all doing that. Our intent 
in making this information known was not to screw 
up the FBI's fun (they're really not doing ail that 
much out of the ordinary anyway), but rather to 
expose a very dangerous individual who goes by 
the name of Cable Pair (some say his real name is 
dohn Maxfield). This person has been posing as an 
extremely friendly hacker who lives in Detroit and 
is just bubbling over with technical information in 
exchange for your secrets. He claims to have been 
one of the nation’s first phreaks. which may or may 
not be true. He gives out his telephone numbers 
freely, will do anything to communicate with some- 
body (like place conference calis from his own 

, private PBX system, provided you give him YOUR 
phone number), and generaily will use anything you 
say to him against you in the future. Our advise is 
simple: stay the hell away from this person. Even if 
you haven't done anything wrong yourself, your life 
can still be made miserable by him if vou're even sus- 
pected of having contact with wrongdoers. 

This latest turn of events has saddened us — we 
thought Cable Pair would be a promising contributor 
to this publication and instead we learned a valuable 
lesson: don’t trust anybody. Have fun, Cab.e Pair. 
Enjoy yourself. Just don't expect to see any of us 
over at the Chestnut Tree Cafe with you. You're 
on your own now. 
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This document contains neither recommendations aor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: 
it and its contents ave not to be distributed outside your agency. 
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bate of transcription__ 2/10/84 
This is a summary of the activities ofl | b6 


Lon GTE Telemail. pre 


used the names[ ana bs 
on Telemail. L~ latse routinely used the bre 
legitimate account registered asL__sdtg . . 


LC Jwas 3 embex—yt a group of illegal users 6 
called the “PHALSERS". was registered as an illegal pyc 
user in following companies: BMW, MARAVEN, TELENET, UAW 
and SCANNET. 


[—__Junder one of his user names accessed bé 
the Telemail system on at least 247 different occasions pyc 
between July 9, 1983, and October 12, 1983. Of those 
occasions, GTE Telemail captured 57 of his messages. 


A fellow _"PHALSER" has me and_can definitely 
identity[ as and b6 
Lis described by this fellow PHALSER as the leader b7C 


of the group and as a part-time volunteer at WUSB Radio 
Station, State University of New York at Stony Brook, 
Stony Brook, New York. 


Information received from 


bTE 
stated to this fellow PHALSER that he 
found out that the FBI _was about to search for computer 
equipment at WUSB. L__Jéurther told this person that bs 
he [las able to contact someone and get some material 
out of the room to be searched before the FBI searched pic 
it. A fellow radio station employee, 
told the FBI that, at the time of the search, gave 
instructions over the phone tolL_————S—=Csdsoncerniing 
savestigation on 2/6/84 at Alexandria, Va. rue Mlexandria 196A-633 
wy Saf ga5 oneaicutes__ 2/6/84 a 
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the room to be searched. After the search, [ ___]thankea 
for calling him and letting him know @ room 
was going to be searched. The fellow PHALSER also said 
that told him that he had qiven a statement to re 
e attorney representing admitting to his 
use of Telemail. also told the fellow 
PHALSER that “our story will be that I'm the only one 
who used Telemail.* 


On November 6 1983,[_—itgs using the legitimate 
account known as left a message to the Public 
Relations Officer of GTE, stating that "we" represent 
PHALSE which is “an organization that has been rather be 
active on the Telemail system over the past few months." BIC 
In subsequent messagess[- described the methods by 
which he and other PHALSERS penetrated the Telemail system 
and admits to reading the messages of legitimate companies 
(e.g. AMERICAN TELEPHONE AND TELEGRAPH messages). 


Finall 


b6 
b7¢ 
b7D 


During the search of the WUSB Radio Station, 
two computer print-outs labelled "“Telemail System Command 
Manual" dated September 20, 1983, were found. These are 
"bootleg" copies of system information that only a legitimate 
Telemail customer administrator should have access to. bé 
These print-outs were found in the same room from which bic 


C4 at [ __lreauest, removed other material immediately 
before the search, 


FO-302 (REV. 28-77) , 


FEDERAL BUREAU OF INVESTIGATION 


10/13/83 


Date of transcription. 


b6 


telephone number 
anaf__ bic 


this residence with 


said that he only_used the Data System 


Terminal located in the bedroom of in order to a 
advised he would rather not discuss the 
activities of his use of the com- b6 
puter equipment located in bedroom. b7c 
bé 
bIC 
investigation on rite #BQ196B-2942 
bé 
SAS pyc 


and 10/13/83 


by. Date dictated. 


This document contains neither recommendations nor conclusions of the FL, It is the proverty of the FBI and is loaned to your agency: 
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Date af transcription, 12/28/83 


telephone 
was telephonically contacted on December 20, 1983. bE 


b7C 
; [__lsaia he had spoken to various “friends” and based on 
their advice ad decided he did not want to talk to the 
Federal Bureau of Investigation (FBI} at this time. 


Investigation on__ 22/20/83 at Hauppauge, New York rie Alexandria 196A-633 
si {Telephonic) Sub E 
oy SA bta pate aictatea__ 12/21/83 b6 
bic 


‘This document contains neither recommendations nor conclusions of the FBI. it Is the property of the FBI and is loaned to your agency; 
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FEDERAL BUREAU OF INVESTIGATION 


12/28/83 


Date of transcription. 


telephone was contacte y Special Agent (SA) 

telephonically from the Hauppauge, New York, Resident Agency o 

Federal Bureau of Investigation (FBI).[_Jwas told that the FBI b6 

would like to interview him concerning statements made to him by BIC 
on the telephone on October 13, 1983, at the time of an 

FBI search of the WUSB Radio Station on the State University of 

New York at Stony Brook. 


first stated he knew nothing about the incident. 
He was then told that the FBI had information that had bé 
askea[__|to go to the room where the computers were stored and 7c 
remove certain materials before the agents could get to them. 
was further told that this removal of items by him might 
constitute obstruction of justice. 


: [sai that he wanted to talk _to an attorney and bé 
LC Jecree to have his attorney call sal at p7c 


the Hauppauge, New York, Resident Agency. 


{Telephonic) 
Investigation on__ 12/20/83 a__Hauppauge, New York rie e Alexandria 196A-633 
Sub E 
vy__SA btd Date dictated 12/21/83 bé 
b7¢ 
This document contains neither recommendations nor conclusions of the FBI, It is the property of the FB! and is loaned to your agency: 


it ang its contents are not to 08 distributed outside your agency. 
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i 
Fi 
11/18/83 
Date of transcriptian. 
Cr orravelcauied the Alexandria Office of the 

Federal Bureau © rivestigation (FBI) on_this date and b6 
requested to speak to Special Agent (SA) b7C 
was advised of his rights orally and he thereafter b7D 


indicated that he still wanted to talk with this arent 
concerning his involvement in the illegal accessing of the 
OTE Telemail system. 


be 
b7Cc 


b7D 


10/19/83 Alexandria, Virginia flexand 


lavestigation on. at Fite a 


bé 


yA rt cee 20702/84 Be 


This document contains neither recommendations nor conclusions of the Ft, It is he property of the FBI and is loaned to your agency: 
it and its contents are not to ne distributed outside your agency. 
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1 11/19/83 


Date of transcription, 


the Alexandria Office of the PS 
Federal Bureau o nvestimation (FRI) on this_date and 


requested to speak with Spectal Agent (SA), Cid PID 


This arent advised Ler nis right to remain b6 
silent and[_—sdJindicated that he was aware of his rights, pie 
sut still wished to talk with this agent concerning illeral bID 
accessing of OTE Telemail system. 


be 
bic 
b7D 


be 
b7c 
b7D 


10/27/83 Alexandria, Virginia Alexandria 196A-633 
Investigation on at Fite w 


by sa tas 10/28/83 Aes 


Date dictates BIC 
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{protect identity), telephonically contacted b6 
the Alexandria Office of the Federal Bureau of Investigation 
(PBI), and thereafter provided the following information: 


b7D 
provided the following information: 


1) 


b6 
b7C 
b7D 


2) 


b6é 
b7c 
b7D 


lavestigation on 12/6/83 a» Alexandria, J File Alexandria 196A-633 
“7 


we h EL, 
ov _—SA[ orem 


Date aictatea 12/6/83 


be 
b7Cc 


This dacument contains neither recommendations nor conclusions of the FB 


Hand is U to your agency; 
It ang its contents are not to De distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


1/16/84 


Date of transcription, 
telephonically contacted this agent 


and thereafter provided the following information: bé 


bIC 
bID 


His date of birth is 
his Social Security Account Number is 
home address is 


also provided this information: 


and 


b6 
b7C 


be 
bICc 


b6 
b7C 
b7D 


b6 
b7C 


investigation on L/11/84 at Alexandria, Va. Alexandria 196A-633 


Fite’a 


oy 8 F285 w/ii/ee es 


Date dictated. b7C 
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it and its contents are not to be distributed outside your agency. 
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Date of transcription__L/25/84 


| home prone[ ___l A 
telephonically contacted this agent on this date. pre 


thereafter provided the following information: BID 


b6 
b7c 
b7D 


bé 
bic 
bID 


investigation on /23/B4 ss as__ Alexandria, VA ___rie » Alexandria —__. 
196A-633 


wv Saf ™~*=éi pate aictatea__ 1/23/84 b6 


bICc 
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1 12/28/83 
Date of transcription 
telephone was advised of the official identities o 
the interviewing agents and thereafter provided the following 
information: Pe 


Cee ls well known at the WUSB Radio Station and 
is considered to be a “phone expert.” During the summer of 1983, 


saw a handwritten note on a bulletin board at the radio 


Station that said something to the effect of "the phone police b6 
are comina," At one point, and were standing b7C 
next to the bulletin board and asked whet that 

sian meant. replied something to the of, "I don't 

want to talk about it." felt that was continuously 


doing something with the phones that he did not want other people 
to know about. 


CL daiso has personal knowledge that[ uses b6 
the telenhone constantly" to make various tynes of telephone calls bic 
to 390 numbers and is much more knowledceable about unusual 
features of the teleohones than other people. 


In anrroximately May or dune, 19e3,[ sid saw 
call some sort of answerine service or messace service on the 
telenhone. lL Jas using the telephone in the radio station 


and the phone wad on a speaker at the time, sav 

punch various buttons on a touch-tone telephone and then a voice 

would sav somethine to the effect, “Press one to leave a messace, 

two to hear 2 message, etc.” wheal Jsaw thatL_ sand a 


others had heard this, he seemed to be very concerned. At this 


same time, also heard a message from to 
being delivered over this message system. clearly 
recoanized voice and knows that and 

are good friends. It is clear to that the messaqe 


being delivered on the telephone system was from[___|to 


L Jsaie that specifically calied the bs 
"message service” to check for his messaqes. Po as pre 
also present when this happened. 


12/20/83 Co Alexandria 196-633 


tovestigation on at File # 
Sub E£ 
b6 
bySAS ate dictated 22/21/83 p7c 
SE bEa Date dictated 
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According to ee moved somewhere be 
te New York. He move n August, 1983. has visited 
oe yasehin the past week. ’ prc 


In a ximately May, 1983, saw 
i a (Last Name Unknown) at a pay telephone 
in the Student Union at the State University of New York Campus b6 
at Stony Brook. Le carrmatched as dialed a bic 
ana[ eas, m calling the Defense Department.” De] 
then sa that the number rang a couple of times and then he would 
receive a dial tone. 


On October 13, 1983, the day the premises of WUSB Radio 
Station were searched by agents of the er[_|was present 
when agents first came to the station_and he indicated 
had a search warrant. At this point,[ _—called 


to report that the agents were there because he thou computer 

in the station belonged to called 

and said something to the effect of, "The one lice are here.” bé 

appeared very disturbed and asked what he meant. pyc 

said, ” is here and they have a search warrant 

or computers.” replied something to the effect of, 

"Thanks for letting me know. There is something we have to get 

rid of or there is something we have to do.” pos aise asked 
to find out if anyone was down_in the room where the 

computer was. reported that was, in fact, 
om and asked to ¢ to the telephone. 


did ca to the telephone and listened 


then_left and apparently went back to the room where 

e@ computer was. says he clearly got the impression 
that was asking o remove something from the room 
where the computer was. 


After the search,[___|cane back to Lana said, 
t was important that you did that,” bé 


*fhank you for calling me 
Co Jacain felt that[____|had succeeded in having] ~=d BIC 


get material out of the room to be searched before the FBI agents 
found it. 
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NAMES OF DEFENDANTS: 


Race Abe 

SEX 1 yo 

Date of Birth | 

Height be 

Weight b7c 

Eyes 

“Iowa Motor 
Vehicle Number 

Address 


AX 196A-633 


Race 
Sex, de 


Date of Birth, mia 
Height 
Weight 
Social Security 


b6 
b7C 


nas 


oa 
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described as: 


Race ae 
Sex ; 

Date of Birth 
Place of Birt bé 
Social Security b7c 


_Account. Number™ 


& 


Address 


05 
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4. | | described as: 


«Race dA 
Sex yf? 
Date of Birth _ 
Social Security _—~ 
. Account,.Number be 
vAddreés’ . bic 


Present Address 


av 
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s. [described as: 


oe 


b7c 


ah 
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Race. jt 
rare cy 
Date of Birth 
Social Sécurity 


Accouremmmser= =]. 
~ provided i subject) 
from NCIC b6 


b7c 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


be 
b7c 


were searched 
warrant and various computer paraphenalia were seized. 


3. On October 13, 1983, the premises located at ee 
pursuan o a duly authorize ederal séarch warrant and 


various computer paraphenalia were seized. 


ha 
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WITNESSES: 


* _--_____ 
elemal 


8229 Boone Boulevard 

Vienna, Virginia 

Telephone |] 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


pecial Agen bic 


Federal Bureau of Investigation 


be 
bIC 


Can supply details of investigation. 


3. 
Special Agent 
Federal Bureau of Investigation be 
Omaha BIC 


Can supply details concerning search ofl | 
. 
Special Agent 


Federal Bureau of Investigation b6 
Tucson bic 


_ Spelt setals sencerning search of | 
re 
pecia gent 


Federal Bureau of Investigation 
San Diego 


Can supply details concerning search of | 


bé 
b7c 


ant 


30 
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7 
pecia gen 


Federal Bureau of Investigation 
Albany b6 
bIC 


Can su details concerning search of 
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EVIDENCE: 
b6 
1. Summary of seven messages left _on GTE Telemail b7c 
b (original in possession of GTE Telemail 


). 


2. Summary of 53 items of relevance seized during 
search (in possession of FBI Alexandria). 


3. Summary of information retrieved from floppy 
discs (discs in possession of FBI Alexandria). 


Summary of trap and trace information received 
from b7E 
(original in possession of FBI 
Alexandria). 
5. List of charges attributable to aka b6 
Lo floriginal in possession of . bic 
6. FD-302 with attached list of items seized in 


search. 


be 
bIC 


Pp 

The other card contains the number 
followed by the name (originals in posssesion 
of FBI Alexandria). 


res [ 


1. Summary of 12 messages left on GTE Telemail b6 
by[__Keriginals in possession of. bre 


2. Summary of 11 items of evidence of relevance 
seized during search (in possession of FBI Alexandria). 


3. Summary of information retrieved from floppy 
discs {discs in possession of FBI Alexandria}. 


4. List of charges attributable colt aka be 
b7¢c 


3A 
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1. Summary of 62 messages left on_GTE Telemail 
byL__—sd(originals in possession offi. 


2. Summary of ten items of relevance seized during 
search (in possession of FBI Alexandria). 


3. List of charges attributable tol —sG aka 
(in possession of [sd 


-_ Summary of 40 messages left_on GTE Telemail 
by ee in possession off i. 


2. Summary of ten items of relevance seized during 
search (in possession of FBI Alexandria). 


3 Co of trap and trace information provided 
by lloriginal in possession 
of FBI exandria). 


4. List of oe ic attributable tol} akaL__] 


and {original in possession 


1. Summary of four i left on GTE Telemail 


by CL (originals with ) 


2. Co of first sheet of a list of names seized 
from aka bearing the listing 
original with FBI 


Alexandria). 


3. List of charges attributable tol ——is«iO‘S aka 
(original with. 


1. Summary of six 4 ae left on GTE Telemail 


byl —s(originals with ). 
Co of first sheet of a list of names seized 
exon bearing the Listieagh 
original with FBI). 


ET 
BD 


b6 
bIC 


b6é 
b7Cc 


b6 
bIC 


bIE 


b6 
b7C 


bé6 
b7c 


b6é 
b7c 


b6 
b7c 


b6 


b7C 


b6é 
bic 
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3. Letter with enclosure sent to FBI Alexandria, 
dated January 14, 1984, by 


4. Letter sent to FBI Alexandria Sd a dated 
January 26, 1984. 


5. 


List of charges attributable i) a | aka 
{original with . 


b6 
b7¢c 


b6 
bIC 


b6 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcriotion 12/15/83 


The followina is a_summ of messages left by the b6 
illeaal user using the name[o don GTE Telemail. pyc 


The date and time of each messade is provided with 
a synopsis of particularly significant messages included. 


1) August 30, 1983, 1:06 p.m. (AL1 times Eastern 
Daylight Time) 
2) September 1, 1983, 8:44 p.m. 
- 3) September 6, 1983, 12:58 a.m. This message is_to 


. b6 
and the text is as follows: "Hi bre 
if you get the chance would you please send the 
programs we discussed?" 

4) September 23, 1983, 9:09 p.m. fessage reads, bé 
"HA «-welcome to Telomail. Let me know how pyc 
you like it." 

_5) September 23, 1963, 9:26 p.m. Message reads, 
“Welcome to Teélemail. Hope that you enjoy the 
system. If you want to send any info, tyre A 
at action. Type exit and you will get the command 
mt There are extensive help commands. Later, bé 
b7C 

6) September 25, 1983, 11:01 a.m. Message reads, 

. “Welcome to the company. See you at the security 
seminar in September." 

7) October 11, 1933, 12:18 a.m. Message reads, 

“Welcome to the services. If I may be of further 
services please let me know." 
fo T 
Investigation on. 12/9/33 a Alexandria, Virginia ce e_Hlexandria 19¢€A-633 
b6 
wy SA btl oate aictotea_ 12/9/83 bre 


This gacument contains neither recommendations nor conclusions of the FBI. It is the property of the FGI and is loaned to your agency: 
it ang its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


11/21/83 


Date of transcription 


The following is a summary of a_review of evidence 
eized in the search of the residence ofl —‘“S™SsSYS b6 
Cd The following articles with relevence bre 
to this Investigation were found: 
1.) A photocopy of a page from the publication 
"80 Micro-Computinge"”, dated March, 1981, with the telephone 
number 1-402-741-7733 followed by the words Telenet local 


access number. This is followed by the words @ mail, 
password = phones, user = phones. 


2 Hand-written note in a red notebook as 
bé 
follows: b7C 


3.) An envelope with the hand-written words: 
Silver Box followed by the letter A-697-1633, B-770-1633, 
C-852-1633, D-941-1633. This is followed by the words Blue 
Box and the number 2600. 


4.) A brown serap paper with the words "Admin 
Hack" followed by the words "Admin/Prime Computer", 


5.) A blue sheet of paper with numerous 800 Modem 
numbers on it and approximately 20 "Wats extenders". This 


sheet of paper also has the words "source online lists users". b6 
This is followed by the number and the words b7C 
Delta Comm. This is followed by the nu and 
the word Kremlin, 

6.) Computer print-out with a message from[ | bé 


on how to hack Telenet. The hand-written words b7c 
"try Telenet-212 99 are found on this print-—out. 
7.) Print-out with hand-written words "AHSC”. 
AHSC is American Hospital Supply Corporation and this was 
one of the companies that was most often penetrated by hackers 
in telemail. 


8.) Print-out of a computer program to search for 
colputer numbers. 


11/7/83 Alexandria, Virginia 


investigation on at File 


ap bé 
oy sa ees bute icatng___ 12/8/83 bre 
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9.) Print-out with messages from TDK (on hacking 


Sprint codes), and others including 
on illegally accessing Autovon, using blue boxes, and various 
Telenet accounts and passwords. 


10.) Print-out of a program to search for MCI 
telephone access codes. 


11.} A program to automatically dial various phone 
numbers, including those for Metrophone access codes and MCI 
access codes. 


12.) A print-out with a message from 
listing "dialups" for the National Institute of Heaith 
Computers. This print-out also contains a message fromL__] 
wherein he offers a Sprint code hacking program and 
“valid Sprint codes". 


13.) A print-out of Edunet file names. 

14.) A print-out of a message fron[ 
listing various computers and connect addresses. There is 
also a message from about a blue box. 

15.) A print-out from the Osuny bulletin board 


with information about how to rig your phone for a long 
distance dialing without being charged. This print-out aiso 


contains KMetrophone access numbers. It also contains a 
message fron{—fuherein he claims to have 70 source 
accounts. There is also a message from Mandrake concerning 
the phone company’s detection of hackers. 


16.) A print-out about phone phreaking. 


17.) A print-out with messages from 
ee connect addresses of Arpanet 
out also contains messages from — fand 


Telenet accounts. 


ts print- 
listing 


18.} A computer print-out of a program to search 
for computer numbers. 


as. A print-out with a message fron[_ sd 


listing Metrophone access numbers. 


20.) A print-out of a program for an automatic 
telephone dialer to get HCI or Sprint access ecdes. 


26 487 


b6 
b7C 


bé 
b7c 


b6 
BIC 


b6 
b7c 


be 
bIc 


be 
b7c 
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21.) A print-o Security Land bulletin 
board with a message fon etving "Mainframe" 
numbers and passwords. This message also contains information 
on Arpanet. 


22.) This 43 a print-out containin, 

access codes left by 
whose residence at 

was searched on October 12, 1983. 


Metrophone 


23.) A print-out containing a program designed to 
search for computer access numbers. 


24.) A print~out of a program designed to search 
for computer access numbers. 


25.) A print-out containing information on w_ito 
ss Telenet, with a message from a hacker know 
This print-out also contains a message from 
containing Sprint codes, MCI codes and Metrophone codes. 


26.) A print-out of a type-written paper titled 
"Cheating power companies, vending machines, etc.” 


27.) A vrint-out with information on how to alter 
your phone to manufacture blue boxes and other devices to 
cheat the phone company. 


28.) A print-out with Telenet access numbers and 
connect addresses, including "Citibank Cash Manager" and 
“Nasa Recon". 


29. A print-out with a messapre tron 
(aka and[ both of which offer 


800 numbers that can be extended to call anywhere in th 
United States and_NCI access codes. The message eronl 1] 
gives the number as a contact number for his 
Modem. 


0.) A photocopy of an MCI credit card issued to 
It lists customer service number 612-544-8171 
and bears account number 
31.) A print-out with numerous Sateleo access codes. 


32.) a print-out with numerous Telenet connect 
addresses. 


PT 28 


b6 
b7¢ 


be 
b7c 


be 
b7C 


b6é 
b7c 


b6 
bIC 
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33.) A paper with various 800 numbers written 
on it. 


34.) A print-out with a message in reference to 
the password to the Boystown PDP-11 Computer. 


35.) A print-out with Compuserve and Source 
accounts listed. This print-out also lists access code 
numbers for overseas long distance lines. 


36.) A print-out from the “Pirates Palace Bulletin 
Board" and it lists numerous Sprint codes, Telenet hosts and 
connect addresses, many of which bear hand-written notations 
such as "O,.K.", "No good”, etc. 


37.) A print-out concerning “Autonet access lists". 


38.) A print-out listing "ADP Autonet Extended 
United States Access Locations". 


39.) A print-out with a list of various bulletin 
boards and phone numbers. 


40.) A print-out with a list of numerous Sprint 
access numbers. 


41.) A print-out of a list of "Pirate Bulletin 
Boards". 


42.) A print~out with 800 numbers and extender codes, 
Sprint codes, MCI codes, and Metrophone codes. This print-out 
also contains password for a source account. This print~-out 
also contains a message describing "phreaking” as a felony and 
stating that sharing information on these bulletin boards is 


“aiding and abetting". ¢ 
43. A_print-out referring to the arrest of a hacker 
known as by the Los Angeles Police Department. 


44.) A print-out with ITT access codes. It also 
contains numerous MCI and Sprint codes. 


45.) A print-out of numerous Telenet hosts and 
connect addresses. 


46.) A print-out of a computer program designed to 
search for other computer numbers. 


pe 
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47.) A print-out of bulletin boards and access 
numbers. 


48.) A piece of blue paper with a Compuserve 
account number, ID number and password. This blue paper 
aiso contains a source connect address, user name and 
password. 


49.) . Another sheet of blue paper with a source 
identification name and password. 


50.) A copy of an MCT bill tol ——sSdC‘ 


51.) A print-out with numerous Sprint codes and 
access numbers. 


52.) A print-out with numerous Sprint codes and 
access numbers, many with hand-written notations such as 
"N. G." and "Check". 


53.) A print-out with numerous Metrophone access 
codes. 


4b 
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FEOERAL BUREAU OF INVESTIGATION 


ate of transcription. 1/30/84 


On October 12, 1983, a search pursuant to a Federal 


Warrant w the home off sd b6 
(foarch Harrant was executed af bTc 
The “flo: discs“ that were seized in this search 
were examined by a computer programmer. be 
The following is a summary © findings concerning bIC 


information on these floppy discs: 


On the dise labelled 196-633 Sub T, 1LBl, Item 
Number 9, Number One, a program called, "Code Breaker for 
the Hayes Smartmodem*® byD was found. This 
is a program designed to find access codes for MCI or some 
similar long distance communication service.. A program 
called "MCI Hacker" is designed specifically for finding 
MCI authorization codes. A program called "MCI FIND" is 
a list of access codes actually found by a computer. This 
was probably produced by the program called "MCI Hacker.” 


b6 
b7Cc 


On the disc labelled 196-633 Sub T, 1B1l, Item 
Number 9, Number Two, a program called "C-SCAN" was found. 
This is a program which searches for other computers via 
the telephone. A program called "“CODE/CHK”" is designed 
to search for authorization codes for long distance communication 
services. This program contains this "you are now running 
one of the most powerful computer programs to search for 
a correct authorization code on many of the different companies 
that provide long distance communication services. Use 
ef this program may be against many different laws.* 


On the disc labelled 196-633 Sub T, 1Bl1, Item 
Number 9, Number Three, had a program called *MNET/OMT" 
was found. In this program appears to be a compuserve 
account number. A program called “SOURCE/OMT” appears 
to contain a source account number. 
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On the disc labelled 196-633 Sub T, 1B1, Item 
Number 9, Number Four, was found a program labelled “MCI." 
This program is designed to obtain MCI authorization codes. 
A program entitled "COMFAST" b 
subroutines, by| designed to search 
for other computers via the phon A program called “SMFIND“ 


is desiqned to obtain MCI authorization codes and was designed 
LT 


On the disc labelled 196-633 Sub T, 1B1, Item 
Number 9, Number Five, appears a message from a hacker 
promising information on how to break in to a computer 
called RSTS. 


On the disc labelled 196-633 Sub T, IBl, Item 
Number 9, Number Six, is the program called "PAMS.” This 
is a listing of other phone numbers connected to computers. 


On the disc labelled 196-633 Sub T, 1B1, Item 
Number 9, Number Seven, appears the program called “TELENET.” 
This is a list of numerous “connect addresses" for Telenet 
computers. A program called "DIAL" is designed to dial 
a telephone number entered into the keyboard and then searched 
for numbers. 


. On the disc labelled 196-633 (fT), 1Bl, Iiten 
Number 9, Number Eight, also labelled “Auto Dial Hack" is 
found a basic program that checks for authorization codes. 


On the disc labelled 196-633 (T), 1B1, Item Number 
9, Number Nine, is found a program called "DIAL" in which 
there is an automatic phone dialing program that mentions 
telenet. 


On the disc labelled 196-633 (Tf), 1Bl, Item Number 
9, Number Ten, is a program labelled “TELECOM." This program 
contains assorted modem control programs. 


On the disc labelled 196-633 (f), 1Bl, Item Number 


9, Number Eleven, is found a program labelled "TERM MASTER.” 
This disc contains sorted programs to control modem dialing. 


42D. 


b6 
b7Cc 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription 730/84 


This report reflects a review of trap and trace 


information and ursuant to a Federal b3 
BIE 
Review of b3 
bIE 
Review of 
b3 
b3 
b7E 
b3 


bIE 


b3 
BIE 
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FEDERAL BUREAU OF INVESTIGATION 


date of teanscriotion.__1/ 31/84 


On January 24, 1984, 


GTE-Telemail, provided a copy of the amount of money b6 
lost by GTE Telemail from the unauthorized use by the hackers. BIC 
This document is broken down by user and by company. 

Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, Auqust and September 
for each company): 
USER COMPANY AMOUNT MONTHS 
| AHSC $62.29 
UAW £21.09 Septe 
b6 
| Maraven Si6.0G Bugust, Sentember bic 
Telenet $108.89 July, August 
| BMW September 
| CBOT $2.00 September 
b6 
| | RADA $1.00 September prc 
$3.00 
| Maraven $24.00 August 
Telenet $325.00 July be 
b7c 
Telenet $151.00 August 


1/25/84 


at 


Alexandria, Virginia 


soerL___] 


rie» Alexandria 196A-633 


Investigation on. 


by 


SA Leek 


Date dictated 


bé 


1/25/84 b7c 
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it and its contents are not to be distriguted outsice your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


fe 


At approximately 8:10 a.m. on Octob 2,_1983, a search 


was ex he premises known as bb 
The following Special Agents pic 
(SAs) of the Federal Bureau of Investigation (FBI) were present 


during the search which concluded at 10:30 a.m. this date: 


b6 
7c 
The attached schedule lists all items of an evidentiary 
value which were seized. All items seized with the exception 
of Item #18 wer cated in the southwest bedroom/office of the bé 
residence by SA {VLB). Item #18 was found bIC 
by SA 


inventory i1tse 


in droom, The 
was prepared by SA (RGC). 


Len 
tnvestigation on__ 10/12/83 a Fite w Omaha 196A-922 


SA SA bé 
»y FETE IICTRTE, 10/18/83 
SA sa TT 
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- This is to certify that on MLL [2/983 
KiB AM 


Investigation, U. S. Department of Justice, at the time of 


or the premises at bé 
b7c 


obtained the attached listed items. 1 further certify that 


at » Special Agents of the Federal Bureau of 


the listed items represent all that was obtained by Special 
Agents of the Federal Bureau of Investigation, U. S. Department 


of Justice. 


Signed 


b6 
bIC 
Witnesse 


Cia gen 
Federal Bureau of Investigation 
U. S. Department of Justice 


bé 


Witnesse b7c 


Federal Bure of InveStigatvion 


U. S. Department of Justice 
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FEDERAL BUREAU OF INVESTIGATION 


1 Date of transcription__2 0/18/83 


At approximately 6:15 p.m. on October 11, 1983, Special 
Agent (SA) Federal Bureau of Investigation 
(FBI), presented an affidavit in support of a search warrant 
to United States (U.S.) Magistrate Richard W. Peterson, Council 


Bluffs, Iowa. This affidavit had previous n authorized b6 
by Assistant United States Attorney (AUSA) Southern b7¢ 
District of Iowa (SDI), Des Moines, Iowa. U.S. Magistrate Peterson 

ap’ warrant for remises known 

as 


The warrant was executed at 8:104.m. on October 12, 
1983, by the following Special Agents of the FBI, Omaha, Nebraska: 


be 
b7Cc 


The search was completed at 10:30 a.m. A copy of the 
search warrant and items seized was left at the premises since 
no occupants were present. It should be noted the side door 
to the residence was left open and access to the house was made 
through this entrance. Efforts to locate the owner of the residence 
were negative. Pottawattamie Sheriff was notified of the search 
warrant. General condition of the house was that it was in complete 


disarray. 
—~¢ 


a 


Three telephones were located in the residence with 


numbers as follows: sO s 
[Wed Uo 


Location Number (eef, 
Southwest | / 
Bedroom , vue j be 
“Master De fone 
Bedroom : Ae 
Investigation on, 1n/11=-14/83 at Fie e_ Omaha 1964-922. 
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The search warrant was returned to U.S. Magistrate 
Peterson at 10:15 a.m., October 14, 1983, at Suite 406, First 
Pederal Savings and Loan Building, Council Bluffs, Iowa. 
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FEOERAL BUREAU OF INVESTIGATION 


1 1/4/84 


= Date of transcription. 


The following is ry of messages left by the 
illegal user using the name jon GTE Telemail. 


The date and time of each message is provided, with a 


synopsis of particularly significant messages included: 


1. July 26, 1983, 6:04 a.m. (All times are Eastern 
Daylight Time) 


2. July 26, 1983, 1:55 p. Mountain Day Light Time) 
This message is from to Phalse and the 


b6 
b7C 


subject is "The first atomic bomb explosion). This pe 


message is an extremely lo e that purports 
by Laura Fermi, 


widow of the nuclear physicist, Enrico Fermi. This 
message mentioned "We lived in Hyde Park which is 


to be a true story told to 


a suburb of Chicago.” 


3. August 3, 1983, 4:28 p-m. This message inquires 
about an ADS System in Chicago. 


4. August 5, 1983, 2:48 p.m. This message is in 
reference to publication of the 2600 Magazine. 


5. August 8, 1983, 12:26 p.m. This message states 
in part "I got a phone call here at home Sunday 
morning from the Sysop of Osuny. This message 
also indicates that the Sysop of Osuny spoke 


withl ————~—S——~—=idon the phone.“ It appears that 


The Sysop of Osu have the hom ne 
nunbers for both[ aka 


and 


6. August 9, 1983, 12:22 a.m. This is another message 


concerning a phone call from the Sysop of Osuny. 


Investigation on 
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Alexandria, Virginia | Alexandria 196A-633 


be 
b7C 


Federal] Bureau of Investigation 
300 North Lee Street - Room 500 
Alexandria, VA 22314 


Dear[__ 


b6é 


This letter is in reference to your various phone calls to me regarding the 


investigation you are conducting. 


you all the information I have available, which was very little. When you 
have called, you have kept insisting that there was something I knew further 


about the case. 


You have_allueded to various coincidences which seem to convince _you that 
Tam the you seek, Today you suggested I was ais 
I would simply like to point out that you had no comparisons to draw at all 


b7C 
Phone 
January 26, 1983 
b6 
bre 
Twas happy to speak with you, and I gave 
b6 
b7C 


until you called me the first time and I voluntarily told you much about myself. 


Because I do volunteer work for the library at the radio ‘station called CRIS 


(Chicago Radio Information Service) you found a connection to 
Because some freak picked up on my BBS phone line several months ago, and 


b6 
BIC 


then disseminated my number to his friends to hassle me, you found a conn- 


When you first called me, you did not even have my correct name, and you 
asked for "R, Benedict" which was my deceased godmother's mme, a fine 
older lady who lived here for many yearg. I told you my mame, and _I gave you 
what information I could. I told you that if there was one call for 


there were fifty of them over the course of the summer. In each and every 


b6 


case I told the caller, "SORRY, WRONG NUMBER," I told you of one such 7c 
caller who called 2-3-4 times from Texas. (he said) who asked for 


You pointed out a coincidence along the way that on_one of the IBM systems in 

your investigation some person used the password I do not know b6 
what to make of this, and while I might agree that there are various things you bIC 
mentioned which have similarities to my own life, Isimply cannot and will 

not assume responsibility for anything someone does that happens to look like 
something about me, 


be 


Now, just by coincidence of course, two “aus after you spoke to me the first 
b7C 


time, [ gota piece of mail for your It did not even have the 

correct address/a partment number (we have no such number ag whatever it 

said). I forwarded this to you without hesitation - unopened - if it would help 

you. Tadded a note saying that of all the times there had been attempts to contact 
this person, it was the first time someone had bothered to write. I have attempted 
to be cordial in our phone conversations, but I do not like your repeated insinuations 
that I willbe inalot of trouble, be forced to come all the way to Virginia, etc. 
Ihave never hesitated to talk to you, even though on both oceassions that you 

called me I had just gone to bed from an overnight work shift. 


You are free to tap my-phone and dont’ need my permission. You are free 

to compile all my phone records, If you think you can uncover some big 

secret out here you are welcome to have someone come and visit... Don't 

even tell me - just surpirse me at 6AM or something. I don't really care any 
longer as longas you will please conclude your investigation where lam 
concerned, My mistake, I believe, was in not getting my phone number changed 
back in the summer some time after I took down the BBS from my line. If these 
freaks or whatnot have passed my number around there is not one thing I can do 
about it, 


You also noted that [hada post office box, Yes I.do and have had for many years, 
Tt is actually registered for this building I think and not just for my use. You 

kept talking about Hyde Park New York, or Chicago. I was born inl 
raised 


bé 
b7¢c 


va 
do 


eir life lives in Hyde Park, a south side ghetto here, No I guess you 


was supposed to be some other coincidence of yours. Believe me, no one who 
iii" anything Igay . 


[TF page 3 


Believe me, sir, I intend absolutely no dis respect for your office or your 
investigation, but there is nothing further I can tell you except to continue 
repeating myself as Ihave done. 


If you persist that I must come to Virginia it will work a very bad hardship 
for me. Ihave little money, and none to spare for travel, etc. I will lose 
time (and money) from work. lam already indebted at work and just keeping 
afloat, due to a theivery here in June for which Iwas held accountable because 
of careless handling of the office money. (Sneak theif while my back wag” 
turned), Iam just now finally getting that money, almost two thousand dollars 
paid off to the owner. I live from one two hundred dollar mycheck to the next. 
If I had to come over there, there is no way I could even buy the ticket right 
now, 


May I offer what I hope will be satisfactory to you? I will submit toa lie 
detector test by anyone you choose. It could be your Chicago office. I will 
also answer any questions a grand jury might want toask, and possibly this 
can be notorized or something in your Chicago office, 


Tam not trying to avoid you in anywa but there is nothing:further I can 

tell you about orl lam not these people and 

I do not know these people, Iam tired of being harrassed by-people loeking 

for them, and I do not want more mail coming Po eee 0 isa.I donot 

like the repeated insinuations about trouble for myself. I cannot even afford 
anattorney for advice regarding this letter but lam. trying to write you ina 

frank and honest way. I want to clear myself immediatty and with no further 
delay. Ido not know any of the other names you mentioned, -except that the 
rame[__|Stood out, I remembered the feliow in Texastsing that name. b6 
This whole matter has me very upset and frankly because of my firancial bic 
situation at present Iam thinking maybe I will sell the computer and forget 

about the BBS since its only a hobby for me anyway. I would not even have the 


money to buy a computer these days -~ Idida couple years ago when I first 
got it. 


If there is ANYTHING further I can do, please let me know, but I sure want 

to clear myself if possible right her e through your Chicago office for the 
reasons mentioned. Iam sending this to you by registered mail to insure that 
you personally get it, and hope to have a reply from you shortly. I do appreciate 
your efforts but I have nothing to do with your problem. Permit me to clear 
myself if you are so suspicious of rhe. Thank you. 


Sincerely yours, 


CT 


PS -- 


T talked just a few minutes ago tL. —=s@d . 
b6 


, He says he told vou about being on the BBS run by pic 
[Jat the Library Car ee ee Seen By Me) 


He says he also told of how_those freaks almost wrecked my other BBS 
when I was running it with (Think BBS). (Was on other phone line) 


He mentioned several mmes to you of those people.. b6 
bIc 


all of whom are a bunch of young kids who like to destroy anything someone 
else starts. 


Also he said you asked mx about "all my phone lines..." 


Thave 3 lines 


be 
bIC 


Pas 
The first is for our office in the apartment building. The second is more-for 
outgoing calls (it has a call pack) we use it both in:the office:gnd far me. 
Also used by xmxx janitar, etc. ties * 


The third used to be for me privately, now its the BBS I operate after the 
fools trashed my other thing, . 


Tf there is anything further at all let me know. Can take a lie detector test? 


C] be 


b7c 
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FEOERAL BUREAU OF INVESTIGATION 


Oate of transcription__ 1/31/84 


On January 24, 1984, 

GTE-Telemail, provided a copy of the amount of money bé 
lost by GTE Telemail from the unauthorized use by the hackers. bIC 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of tf above doc 
indicating totals by each user, combining multiple user ne 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY 


ONTHS 


be 
bic 


| CBOT $2.90 September bé 


b7C 
$3.00 
| Maraven $24.00 August 
Telenet $325.00 July bE 
b7c 
Telenet $151.00 August 
ces Pd 
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FEDERAL BUREAMHOF INVESTIGATION 


“ Date of transcription __L2/15/83 


The following_ia a summa of messages left by the be 
ittegal user known as[ fand[ Jon re 


GTE Telemail. 


The date and time of each message is provided with a 
synopsis of particularly significant messages included. 


1} August 30, 1983, 12:57 a.m. 

2) August 30, 1983, 1:07 a.m. 

3) August 30, 1983, 1:12 a.m. 

4) Augu 30, 1983, 1:18 a.m. This message is from 
“Ka@ybis" to The message reads, "Through b6 
the airport?? You think a kilo would be a bit b7c 
obvious. I know John Delorean, ya know.” 

5) August 30, 1983, 1:30 a.m. This message reads, 
"What happens when the dogs eat my leg??" 

6) September_1, 1983, 5:12 p.m. This message reads 
*He11o[ Jang anyone else reading this text. —_ b6 
that hoochie is 100%! I've already gone throug b7C 
half what I bought. I'm gonna save the rest and buy 
another, Anyone interested in trading MCI nodes and 


codes?" 
7) September_8, 1983, 10:27 p.m. This message reads in 
part, | ‘as of 7:30 this evening, I have not bé 


heard anything on our 'shipment'." b7c 


8) September 8, 1983, 10:39 p.m. This message reads, : a | 
‘I let our computer phone number search program run for 

about three hours tonight. All I got was a shit load 
of Telenet accesses. Ah well call me huh?" 

9) September 10, 1983, 11:21 p.m. 

10) September 10, 1983, 11:24 p.m. 

11) September 13, 1983, 12:53 a.m. 

12) September 21, 1983, 12:07 a.m. 


Investigation on 12/9/83 Alexandria, Virginia cue « Alexandria 196A-633 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _12/1/83 


The following is a review of evidence seized 


pu. 
at 


rrant conducted b6 
on October 12, 1983. b7c 


The following is a summary of the evidence that is 
relevant to this investigation: 


{1) 


(2) 


(3) 


(4) 


A brown heav: 
addressed to 


aper envelope that was 


bé 
and the return address is bIC 
1s also known as 
A packet of white sheets of paper stapled 
On the first sheet is 
followed by the number 
d page of this item is fe name 
b6 
From b7e 


S same sheet of paper is a number 
numbers 1, 123, and the 
password “ This phone number is 
the modem phone humber a 
and the numbers and password are_the 
account number and password for[__ 


lon that bulletin board. 


This item is a scrap of greenish paper containing 
numerous telephone numbers. On that sheet of 
paper is the word "Mail" followed by a dash 

and the word "Phones" followed by another 

dash and the word "Phones" again. That 

sequence of words allows a person to get 

every Telenet dial up number from the Telemail 
System. 


A scrap of white paper with four telephone 


numbers on it. Also _appeari the sheet be 
of paper is the nasef PIE 
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(5) ite paper with the number b6 
written on it. bIC 
(6) A computer i that came from 


b6 
b7c 


about the ITT 
Dialcom Network. In this message, 
leaves an ITT Dialcom account and 
password. also says he has 
about seven other accounts on ITT Dialcom. 


(8) A computer print-out_from 
bulletin board from n is 
message he gives the telephone number for 


the University of Kentucky computer and gives 
you a log-in code. Ca ete leaves 
five source accounts with the instructions to bé6 


dial up Telenet and stating that you can access p7e 
the source system by hitting "C" then a space 
then "30128" on your keyboard. This_message 


is followed by another message from[|_ | 
eee ear which he lists “at 
eas main frame computers and their 


telephone numbers. Examples of the computers 
are Michigan National Bank, University of 
Hartford, Charge Card Association, Michigan 
Bell. 


{9} A print-out of a "telephone modem search” os 


(10) A photocopy entitled, “Local Telephone Numbers 
for Access to the SPRINT Network." 


{11) A computer print-out entitled, “How to Cause 
Car Trouble." This lists numerous things 
a person can do to damage an automobile 
such as "Pour Draino in the radiator. 
Pour sand in the crank case," and numerous 
other methods for damaging someone's car. 
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FEDERAL BUREAU OF INVESTIGATION 


Oate of transcription. i/i 6/8 4 


a computer programmer, examined 


various “floppy disks* that were seized pursuant to a 6 
Federally approved search warrant at the residence known b7C 
as This is the 
[_Jfound the following information of bé 
interest: bre 


On a floppy disk labelled 196-633~-Sub I 1B1, 
Item Number 3 (one of eight), Number 1, the following 
information was found: Under a heading "OMNICOD/BAS" appears 
a program that searches for access codes to computers 
or long distance networks. Under a heading known as "SPCODE/BAS" 
appears a program that will break MCI “access codes" or 
other similar services. A program labelled "SPTRVCD/BAS" 
appears to also attempt to break long distance access 
codes. A program known as "COMFIND" searches for other 
computers via the phone. 


On the floppy disk labelled 196-633-Sub I, 1Bi, bé 
Item Number 3 (two of eight), Number 4, found pmc 
the following programs: "Code Breaker for the Hayes Smartmodem". 
This program tries different access codes for a given 
phone nubmer, probably to get access codes for a long 
distance service like MCI. 


A program known as "Breaker/BAS" is a program 
similar to the one above, but slightly more sophisticated. 


A program known as "Break/BAS" appears to be 
an earlier version of “Breaker/BAS". 


On the disk labelled 196-633-Sub I, 1Bl, Item 


Number 3 (one of eight), Number 3, found the bé 
following: A program labelled "Message/TXT". This is bic 
a listing of vari. ssages left on a home bulletin 


board set up by The program known as "Member/DAT" 
is a listing of various people authorized to use 


"bulletin board", 
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On the disk known as 196~633-Sub I, 1Bl, Item 
Number 3 (one of eight), Number 2,[__—_—sdifound a program 
labelled "“PHONE/TXT". This is a listing of messages from 
the Osuny bulletin board. 


On the disk labelied 196-633-Sub I, 1Bl, Item 
Number 1, Number 4,[___———sJfound a program labelled 
"COMPROG/BAS". This is the beginning of a program to 
search for other computers over the phone. On the program 
labelled "CODE" appears a program to find codes for services 
like MCI. also found three programs labelled 
"COMV3/BAS", "COMFIND/BAS", and "COMMFID/BAS", all of 
which are programs to search for other computers by the 
phone. The program labelled "TRAVCOD" is the same program 
as the previous one labelled “CODE”. 


On the floppy disk labelled 196-633-Sub I, 1Bl, 
Item Number 1, Number 6,L_____ found the following 
programs: A program labelled "COMV41" which is a program 
for searching for computers by phone. A program labelled 
"FINDINGS" lists the results of the program produced by 
“COMV41". A program labelled "MCIV41" searches for MCI 
access codes. A program labelled "MCIFIND" lists the 
results of the above program. 


On the floppy disk labelled 196-633-Sub I, 1Bl, 


Item Number 1, Number 8,[ __———s[found the program "RUSERS/LOG". 


This program lists various users from a home bulletin 
board. 


On the disk_labelled 196-633-Sub I, 1B1, Item 
Number 1, Number 13, found a program labelled 
“PINDINGS". This program lists the results of a computer 
search program, apparently from the previous program labelled 
"COMV41". ° 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription / 31/84 


On January 24, 1984, 
GTE-Telemail, provided a copy of the amount of money b6 
lost by GTE Telemail from the unauthorized use by the hackers. b7C 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


_ 'ISER COMPANY AMOUNT MONTHS 
| AHSC $62.29 July, August, 
September 
UAW . £31.09 September 
be 
| Maraven S$lo.U0 August, September b7c 
Telenet $108.00 July, August 
CLs BMW $0,29 September 
$127.58 


LC cBoT $2.00 September b6 
BIC 
| RADA $1.00 September 


| Maraven $24.00 August b6é 


b7C 
Telenet $325.00 July 
Telenet $151.00 August 
Sos £ 
Investigation on 1/25/84 a Alexandria, Virginia rie e Alexandria 196A-633 
by SA stk Date dictated 1/25/84 — 
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FEOERAL BUREAU OF INVESTIGATION 


Date of transeriotion. 1/5/84 


The following is a essages left 
by the illegal user known as on the GTE be 
Telemail system. ‘The date and time of each message bic 


is provided, with a synopsis of particularly significant 
messages included. 


1.) July 7, 1983, 8:49 PM (ali times eastern 
daylight time). 


2.) August 17, 1983, 12:26 AM. 


3.) August 83, 2:50 PM. This message be 
reads, "Are you serious What's this younger bic 
generation coming to.” 

4.) August 17, 1983, 5:20 PM. 

5S.) August 18, 1983, 5:48 PM. 

6.) August 15, 1983, 7:16 PM. 

7.} August 17, 1983, 7:35 PM. 

8.) August 18, 1983, 7:54 PM. 

8.) August 20, 1983, 8:31 PM. This message 
reads, “Did you know that 202141 is the same as Telemail? 

I didntt.* 
10.) August 24, 1983, 6:52 AM. 
il.) August 3, 12:44 AM. This message be 
is to[__land is signed b7c 
12.) August 27, 1983, 4:45 AM. The content 
of this message indicates that [| ____ first 
name is[__Jand that he knows f ome phone number be 
to the hacker known as This message also bre 


indicates that this person talked to the manager of 
a computer system and threatened to damage their computer 


system. 
Investigation on 12/8/83 Alexandria, Va. ruetlexandria 196A-633 
mL ga oute aetntea___ 12/8/83 bé 
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13.) August 27, 1983, 6:13 AM. 
14.) August 27, 1983, 2:46 PM. 
15.) August 29 


is from Admin/Raytheo: 
as follows: * i 


1983, 4:03 PM. This message 
The message reads 


You may want to change 


bé 


the PWD until cools off. I _didn't REG my pre 
user name, but I'd like one. Signed . 

16.) August 29, 1983, 8:04 PM. 

17.) August 29, 1983, 10:03 PM. 

18.) August 31, 1983, 1:51 PM. 

19.) September 1, 1983, 4:13 AM. 

20.) September 3, 1983, 2:34 AM. 

21.) September 4, 1983, 4:46 PM. 

22.} September 4, 1983, 4:59 PM. 

23.) September 6, 1983, 3:51 PM. 

24.) September 7, 1983, 2:45 AM. 

25.} September 6, 1983, 7:31 PM. 

26.) September 6, 1983, 3:54 PM. 

27.) September 10, 1983, 1:30 AM. 

28.) September 10, 1983, 2:31 PM. 

29.) September_1ll, 1983, 4:00 AM. This 
message reads i Knot the original) 
who runs is a phreak. Nothing b6 
special.™ bulletin board bIC 
run by who was a subject 


in this matter. 


30.} September 13, 1983, 2:51 PM. This 
message reads in part, "There's no telling how long 
this will be up, but I have been on here for about 
a year with no problems." 


Ole 
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31.) September 13, 1983, 11:21 PM. This 
message reads as follows: “The people at Telenet will 
know we're here sooner or later and they may or may 
not get angry; so don't post things that give your 
name or number and you may want to use a node other 
than your own. Some phreaks loop their calls all over 
the U.S." 


32.) September 14, 1983, 3:25 AM. This 
message reads in part, "We_are not the only phreak 
people on the system, and got the FBI after 
him by deleting Nasa's major node.* The message also 
contains the sentence, "I was also a member of both 
PHA and Innercircle and am now a member of Securityland." 
This message also contains the PS: "All this talk 
about who I am (sic} because I can see how great this 
would be if I worked for the FBI." 


33.) 4, 1983, 10:37 PM. This 


message is fron[ fol Jana reads, 
“aif }-weil I also have been hacking on Telenet 

for quite a while (not as long as you) and this is 

not my only T-mail admin. This group is not really 
mine but I adopted them because I plan on dumping Telemail 
soon anyway (very strong rumors that Nasa had some 
major trouble and had the FBI on Telemail). For this 
reason I won't give away anything else, except that 

if you can get on beard you can contact me there. 
Quite a project if youtre government. I'd also like 

to say that I left everything open here on purpose 
figuring that if Telenet was looking for me they would 


find me otherwise I don't care who sees 
have more private groups though. Signed . 


34.) September 14, 1983, 10:42 PM. This 


message is from Admin/SCPP/Bang/Promo/Raytheon to SCPP. 
Subject is: Text of the message is "I 
am land my address isl sd 


35.) September 15, 1983, 1:29 AM. This 
is from Admin/Promo/Raytheon to SCPP, subject "Also 
Text of the message is "I am also The 
-Only in a more powerful state.* 


q\ 


be 
bIC 


b6 
b7C 


b6 
b7C 


AX 196A-633 4 


36.) September 15, 


37.) September 15, 
message reads as follows: 


1983, 


1983, 


1:27 AM. 


1:15 AM. This 


“The Telenet people can 


easily find out which node you call from; in fact, 


it will be on the bill to be sent out about now. 


But 


many Admins don't look for the user name or anything 


like that. Oh yes, 
38.) September 15, 
39.) September 15, 
40.) September 15, 
41.) September 15, 
42.) September 15, 


of this message is as follows: 


1983, 
1983, 
1983, 
1983, 


1983, 
“Oh 


I do not work for the FBI." 


1:59 AM. 
2:00 
1:19 
1:32 


4:18 PM. The text 
it was just a thought...1 


had heard that the FBI was looking into Telmail (SIC) 


because someone deleted Nasa and Unix...True? 


I know 


someone who told me they deleted Unix a while 


and he could well have deleted Nassa. 


43.) September 15, 
44.} September 16, 
45.) September 16, 
46.) September 17, 
47.) September 18, 
48.) September 19, 
49.) September 21, 
50.) September 23, 
51.) September 24, 


message reads in part, 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 


1983, 


"Ah you shouldn't 


signea[ J" 
7:49 PM. 
aM. 


PM. 


AML 
AM. 


6:35 AM. This 


have mentioned 


the Oak Industries Vax, now you'll have to hear how 
I broke in on their Vax and had them beg for mercy." 


be 
b7¢ 
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The message continues, “Well it's been almost two years 
and I just got a breakthrough that will give me an 
account before too long. I don't know whether to use 
it for years quietly or destroy the Vax." 

52.) September 24, 1983, 6:20 PM. 

53.) September 26, 1983, 2:31 AM. 

54.) September 27, 1983, 2:32 AM. 

55.) September 27, 1983, 5:55 AM. 

56.) September 27, 1983, 5:56 AM. 

57.) September 27, 1983, 6:10 AM. This 
message reads in part, “When I was a member of PHA 
(Phreakers of America) and two generations of TIC (The 
Innercircle) we did all kinds of things that did nothing 
but waste time, to show that we were a group. We set 
up and took down boards, arqued over different logos, 
voted members we didn't like out, etc." 

58.) September 29, 1983, 7:12 PM. 

59.) October 1, 1983, 9:17 PM. 

60.) October 2, 1983, 4:30 PM. 

61.) October 2, 1983, 4:33 PM. 


62.) Octoher 3, 1983, 7:55 PM. 


omen, 
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FEDERAL 8UREAU OF INVESTIGATION 


1 Date of transeription 12/28/83 


The following is a review of items seized in a court 
ized search of the premises known a bé 
a on October 13, 1983. The following items o bic 
relevance to this investigation were found: 


1 A spiral bound notebook containing the name b6 
and the telephone number(s pIc 


£ 
_ — 3 bé 
some sort of a computer war game that bothl Janet bIc 


are involved in. 


A post card from 
This_pos a ears to ve 
discuss a computer war game that and are c 


involved in. 


4 A_white 3-inch by 5-inch card_bearina the name 
telephone number bE 
address bIC 


5) A white 3-inch by S5-inch card bearing the name 
address b6 


6 A white 3-inch by 5-inch card bearing the nam 
telephone number b6 
address bie 


7) A Geinch by 12-inch water color 
i the following information: 


ad with the first 


This 
sheet of paper also bears the telephone number 


followed by the word[ It also has the telephone number a 
Do feriowed by the name It also contains the 
telephone number The note pad_aliso bears the 

name followed by the televhone number 


This pad_also has the name[__ followed by the telephone 
number 


snvestigation on_1 2/22/83 Alexandria, Virginia rue Plexandria 196A-633 

Sub F 

S: btd bé 

vy SA pate gtctates_12/22/83 bic 
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co A white sheet of paper bearing the telephone number = >6 
BIC 


9) A white card bearing numerous telephone numbers and 
a dial up number and access code for Ditt DialCom Computer System. 


10) Approximately 30 sheets of computer paper stapled 
together and labeled RDF Start Up Routines. 
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FEDERAL BUREAU OF INVESTIGATION 


\ 


Gate of transcription _2/ 31/84 


CL] GTE-Telemail, provided a copy Of the amount of money 


ost by GTE Telemail from the unauthorized use by the hackers. pic 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each ‘company): 


USER COMPANY AMOUNT. MONTES 
a nus $62.29 
UAW . $31.60 
bE 
| Maraven $16.90 August, Seotember pic 
Telenet $108.90 July, August 
ee BMW $0,29 September 
$127.58 


BITC 
| RADA $1.00 September 
$3.00 
Lo] Maraven $24.00 August be 
pTc 
Telenet $325.00 July 
Telenet $151.00 August 
joa F 
Investigation on. 1/25/84 a _Alexandria, Virginia rues Alexandria 196A-633 
bé 
by SA sfk pate aictatea___ 1/25/84 pic 
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FEDERAL 8UREAU OF INVESTIGATION 


1 Date of transcription. 1/4/84 


The following is a_summar eft by the 
illegal user using the names and Pee 


on GTE Telemail. 


The day and time of each message is provided, with a 
synopsis of particularly significant messages indicated. 


1. July 10, 1983, 5:33 p.m. 

2. July 16, 1983, 12:32 a.m. 

3. August 2, 1983, 7:06 p.m. 

4. August 5, 1983, 2:46 a.m. 

S. August 8, 1983, 10:08 p.m. 

6. August 10, 1983, 10:01 a.m. 

7. August 10, 1983, 11:00 a.m. 

8. August 10, 1983, 10:46 p.m. 

9. August 12, 1983, 6:39 p.m. 

10. August 26, 1983, 12:40 a.m. 
11. August 26, 1983, 12:46 a.m. 
12. August 28, 1983, 12:54 a.m. 
13. August 28, 1983, 1:02 a.m. 

14. August 31, 1983, 9:32 p.m. 

15. September 3, 1983, 10:49 p.m. 
16. September 4, 1983, 7:02 p.m. 
17. September 10, 1983, 7:18 p.m. 
18. September 10, 1983, 7:31 p.m. 
19. September 12, 1983, 11:16 p.m. 
20. September 12, 1983, 11:08 p.m. 
21. September 12, 1983, 11:17 p.m. 
22. September 12, 1983, 11:37 p.m. 
23. September 15, 1983, 11:05 p.m. 
24. September 15, 1983, 11:09 p.m. 
25. September 15, 1983, 12:12 p.m. 


This message reads "Does anyone think we will be better 
off if we made a separate phone call for each connection to tele- 
mail? Would that make us look more like the real thing?" - 


investigation on. 12/8/83 at Alexandria, Virginia rie «Alexandria 196A-633 


b6 


oy SAL Faken bate sctavea 12/8/83 bic 


This document contains neitner recommendations nor conclusions of the FBI. It is the property of the FBI and is laaned to your agency; 
it and its contents are not to be distributed outside your agency. 


Fre wl 


nN 


AX 196A-633 2 


September 16, 1983, 8:17 p.m. 
September 18, 1983, 2:09 a.m. 
September 19, 1983, 12:24 a.m. 
September 19, 1983, 11:44 p.m. 
September 22, 1983, 10:45 p.m. 
September 26, 1983, 9:12 p.m. 
September 28, 1983, 7:44 p.m. 
September 28, 1983, 7:45 p.m. 
September 28, 1983, 8:39 p.m. 
September 29, 1983, 11:28 p.m. 
September 29, 1983, 11:48 p.m. 
October 1, 1983, 7:35 p.m. 
October 2, 1983, 9:51 a.m. 
October 2, 1983, 11:35 p.m. 
October 9, 1983, 12:21 a.m. 


ws 
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FEDERAL BUREAU OF INVESTIGATION : 


12/5/83 


Date of transcription 


The following is a summary of the review of seized 
evidence obtained pursuant to a duly-authorized Federal search 


warrant executed on October 12, 1983, at the. residence of b6 
b7c 


The following is a summary of the evidence that 
is relevant to this investigation: 


l. A computer card bearing the number 800-424-9494, 
with the word "telenet" written underneath it; 


2. A computer card with the words[__jand 
written on it; also written on this card are the b6 


words "“cbhot", "scannet", “dialcom", and "tymnet"; bIC 
this card aldo contajns’ ene word, 


3. This item is a yellow sheet of paper with numerous 
phone numbers associated with bulletin boards; also 
found on this sheet of paper is the number 


followed by the word "Voice" and the name a 
this sheet of paper also bears the address 
it also contains 
followed by the telephone 
number 
4. A white sheet of paper bearing numerous phone numbers, 
some of them identified as oliows:[ be 
This_paper also contains the name prc 
and_the hunber[o |} and the name[___Jand the 
number 
5. Amessage addressed tol 7} 
date 3 PM, Sept: er 15, 1983. 
and in the remarks section b6 
called. Be on campus 9:00 bIC 
Number "On the 
back of this message are the words and 
Investigation on___2L/15/83 a» Alexandria, Virginia rucelexandria 196A-633 
b6 
w SAP stk ante acted 11/15/83 b7e 
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6. 


10. 


2 


White sheet of paper with the name = 
LC} It also contains the name 
and next to that the word is sheet 
an a also contains the name andl 


A white sheet of computer paper with the word "Black" 


and the number 
also bears the 


"800 
word 


-523-0684". This sheet of paper 
"NASA", "ARC", "JPL". These 


are all host companies on telemail that were penetrated 


by hackers; 


A white sheet of paper bearin. = 


". This sheet of paper also has the words telemail 


check; 


A white sheet of computer print-out paper that has 
numbers listed for ITT, Metrofone, Telenet, Sourcenet, 
Sprint, followed by what appeared to Sprint access 
codes; Allnet and two 800 numbers; 


A sheet of computer print-out paper 

word Maraven, followed by the vera 
[| 'anal__"} “followed by the word 
ha Thi hee 


£ er also has the words 
and 


W 


BIC 


b6 
BIC 


bé 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription__1/ 31/84 


On January 24, 1984, 


Lo) GTE-Telemail, provided a copy of the amount of money be 
lost by GTE Telemail from the unauthorized use by the hackers. bic 
This document is braken down by user and by company. 
Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals hy each user, combining multiple user names 
this summary covers the months of July, August and September 
for each company): 
USER COMPANY AMOUNT. MONTHS 
| AHSC $62.29 July, August, 
September 
UAW . $31.00 September 
b6 
| Maraven $16.00 August, September b7c 
Telenet $108.00 July, August 
| BMW $0,29 September 
$127.58 


| CBOT $2.00 September bse 


: BIC 
| RADA $1.00 September 
$3.00 
| Maraven $24.00 August 
b6 
Telenet $325.00 July pyc 
Telenet $151.06 August 
Seat 
investigation on 1/25/84 a Alexandria, Virginia rues Alexandria 196A-633 
b6 
by SA stk pate aictatea___ 1/25/84 pre 
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FEDERAL BUREAU OF INVESTIGATION 


iL pate ot transeriotion_2/4/84 
The following is a summary of me 8 left bé 
by the illegal user using the nane| fen GTE pre 
Telemail. fhe date and time of eac message is provided, 
with a synopsis of particularly significant messages 
included. 
1.) August 15, 1983, 12:17 AM. 
2.) August 15, 1983, 12:24 AM. 
3.} August 18, 1983, 1:18 AM. 
4.) August 19, 1983, 12:18 AM. 
lavestigation on 12/8/83 a Alexandria, Va. rfpexandria 196A-633 
: bé 
by SA gaj pate cictarea__ 22/8/83 b7C 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transeriotion__1/31/8 4 


On January 24, 1984, bé 


Ct GTE-Telemail, provided a copy of the amount of money pic 
lost by GTE Telemail from the unauthorized use by the hackers. 


This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 
LC 7 AHSC $62.29 July, Aucust, 
September 
UAW . $31.00 September 
bé 
LC] Maraven $16.00 August, September b7c 
Telenet $108.00 July, August 
| . BMW $0,29 September 
$127.58 


L__s«d CBOT $2.00 September b6 


b7C 
Csiézd RADA - $1.00 September 
$3.00 
Lo 7 Maraven $24.00 August 
Telenet $325.00 July bé 
7c 
Telenet $151.00 August 
sea PL] 
Investigation on 1/25/84 a Alexandria, Virginia rues Alexandria 196A-633 
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Date of transcription __ 2/15/84 _ 


ng is pe summery ary of the activities 
akaf on GTE Telemail. be 
| using the alias | was bic 
an illegal user In three different telema companies 
as follows: \ 


AMERICAN HOSPITAL SUPPLY COMPANY (AHSC) 
RADA COMPANY 


MMM COMPANY 

Cais known to have left at least ten 
messages on the GTE Telemail System from August 31, 1983, bb 
to October 11, 1983. BIC 


In late September, 1983,[/__]began "welcoming" 
new illegal users to the telemail system. 


On September 20, 1983, September 21, 1983, 
September 22, 1983, September 23, 1983, and again on 
September 24, 1983, the GTE Telemail security log detected 
a hacker attempting to break into forty different legitimate 
telemail administrator accounts. All of these calls came from 
the 402 area code and into telenet dial-in number 
Trap and trace records received from 


b6 
b7c 
b7E 


Investigation on 222/84 at ria, Virgs rie. Alexandria 196A-633 
Sub T 


wo sal SSC*ié me ate ictates__ 222/84 ib 
b7c 


This document contains neither recommendations aor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: 
Wt and its contents are not to be distributed outside your agency. 


a4 


FO-362 (REV. 3-8-77) @ r ) 


FEDERAL BUREAU OF INVESTIGATION 


1 ate of transeription__ 10/1 B/R3 


October 13, 1983, a male identifying himself as 
telephonically contacted the Omaha office of the 
Federal Bureau of Investigation (FBI) i that he was 


at that time in San Diego, California. continued that be 
. . nen b7c 
he had been informed that his residence 
had been "ransacked," and that “some piece cf paper" had be 
left at his house. 
was informed that his home had been searched 
on October 12, 1983, by Special Agents ‘SAs} of vee 
to a warrant issued py a U. S. Magistrate for 
of Iowa (SDI), and that since no 
a copy of the warrant and inventc 
of the warrant was prominentiy at 
reqrigerstc er Aa 

es further int be 
“ransacked” was inaccurate in tha bye 
SAs nected that every room in the 
total disarray. 

[stated he was concerned that his profeszional bé 
papers had been seized and he could ner conduct his business pic 
without them. 

He was informed that items taken were. selective 
seized as being related to or evidence of the criminal co 
specified in the search warrant, Fraud 2y : 

[stated he had been at his home on only four bé 
eccasions during the last two months, and wondered whether some pyc 
"kids" may have been using his computer. 

added that his house is always open, and anyone b6 
can enter the house at any time. po ~ IC 


Investigation on. 10/13/83 a Omaha, Nebraska 


by. 


Date dictated 
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The following is a summary of the activities 
of Jon tetemaiz. 
bé 
used the names bie 
in the companies known as RADA and MMM. 
as accessed telemail approximately 12 times from August 
30, 1983, to September 21, 1983. 
His messages include references to drug usage 


and plans for interstate transportation of drugs and to 
“trading” MCI long distance access codes. 


On October 12, 1983, admitted to accessin be 
GTE telemail to communicate wit pre 


and 
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1 Date of transeription__10/17/83. 


“ At 6 A.M., on October 12, 1983, 
were awakened at their residence at be 
at which time they were advised as to the iden’ es of b7C 


the interviewing Agents and the purpose for the Agents being at 
their residence. 


At 6 A.M., a search warrant w 


for the search. of his eatgant was served on[ 1] 
advised his son did h uter and it was located 
in his son's room, At this tine was awakened 
and advised as to the identities of the Agents and the purpose for bé 
their presence. At this timel appeared to be hyperven- = p7c 
tilating.L———s—~—~—éi‘(Cs explained) to the Agents where his records 
were concerning his computer. pointed out the one 
diskett that contained all the computer records of his 
‘ General Telephone and Electronics’ (GTE) Telemail. SA 
wrote "Telemail® on the corner of this disk. 
taken to the kitchen and interviewed in the presence o 


Both and ee | -were advised 
that was a subject in the investigation, 
however, there was no arrest warrant for his arres d_ further 
that he was not going to be arrested on this date. bé 
was advised that he did not have to talk to the PBI, however, he was »7¢ 


asked if he did wish to be interviewed to i was 
willing to talk to the FBI. At this time 


provided the following information: 


was then 
is father. 


Approximately two to three months past he was using his 
computer through Compuserve, a service he was paying for out of 
Columbus, Ohio, His access number in Tucson, Arizona, for 
Compuserve is This is an open line that can be used 
like a CB radio. Anyone can talk to anyone that subscribes to b6 
this service. Through Compuserve he talked to_an individual who b7c 
used the name! He does not know if[_——sdwass a true 
name or not. told him he could use GTE's Telenet system 
to send messages. told him to_dial Telenet, 747-0107 and 
then type in Pein nisl First = dave him wash 


Later he told him his account was 


bé 
He did send messages to people using the GTE bic 
Telenet System. He talked with (true name not recalled) veh > 
Tee 


gk fin usp oO 


PX 196A-1325 


b6 


who is a male who said he lived close to Los Ange rnia. 
He located a note from his records that reflected 
telephone number as He also located a_brown 


envelope from his records that he had_received from 
which reflected a return address of 


true name is 
whose residence telephone_number is and 
bulletin board number is 


true name is 
note from his record reflectin 


He located a 
land address 
He advised 
telephone number is 


Be talked tof 
and_spver the Telemaii accounts. 


believes 


the codename He saw_one message in i the 
name[__lwas used instead of codename in ich said 
he was going to Detroit for a CB conference. was always 


bragging about changing the pass words in the computer of Miter 
Corporation, Arpanet System, which is designed for research 
corporations, He changed the pass words because the systems 
administrative caught him in the system and told him et off. 
In talking with lon Compuserve he asked what 
happened to his accou in that he tried to use it 
and it was not there. told him some of the accounts had 
been erased and that was trying to set up new accounts, 


f__} true name unknown, told Thow_to 
access Telemail. In a conference_call between 

and himself was bragging about his 
use of the Arpanet System. also bragged and said that 
he had erased 200 NASA Accounts. had more knowledge 


about the Telemail system than anyone else. 


was a Hacker who used both Compuserve and 
Telemail who he believes lives in Oklahoma City. He does not 


know the true name for He sent and received messages 
from and through these messages said he 
lived in did not Iive far away. In 
convers said he lived within an 
hour of 


bIC 


bé 
bic 


b6 
b7Cc 


b6 
b7Cc 


bE 
b7C 


b6 
b7C 


bé 
b7c 


bé 
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be 


He talked withL _————S—S—S—Cston. Compusserve and saw 
hame on Telemail. He did not use Telemai 
He believes is a friend of 


talk_with 


to a party wit 
several people used the codename of 


He recalls seeing the name [ __, _icodenane) on 
Telemail and believes he may live in New York. 


Cee ton pa had gotten his 
new account for Telemail from lover Compuserve. 


gave him his new account, name of 
He does not know where ot the new account. However in 
later conversations with andL____———sdhe-was told by 
them that[_ sd Jhad set up the new account. 


He believes 


He believes[__——sdjwas the one who started illegally 
using Telemail. 


[.__]gave him an account number 405,206 and the 


password "Bad Boy" to enter the University of Kentucky Dec Systems 
io. Dec Systems 10 is 

telephone_t He was on the system when 

gave him the account number and password. 


said it waS okay to use the system as long as they did not erase 
any files. 


es used_ SOURCE which is a GTE Telenet System 
and is similar to Compuserve.[ _Jerased a lot of one section 
“ef the computer in SOURCE. They were aware 


erased the system but they did not know_who was, They 
closed all the accounts under the name . 


The codename 
with the codename 
true name is 


was also used in conjunction 


true name unknown, lives in 
and _ also uses 


was telling everybody how to access Sprint and other 
telephone systems. 
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also told people how to make boxes that 
roduced tones to access telephone systems without paying. b6 
offered these boxes for sale for $30 each. Sai BIC 
he was|__jyears old and his telephone number is 


He also advised thatL—salso sent him information 56 
on how to access Sprint. biIc 


He did not know any of these individuals prior to the 
use of Telemail nor has he ever personally met them. He did not 
know any of these systems were being illegally used and he did not 
profit in any way from the use of Telemail. 


[_—} is aeseribed as fotioxs: 
Race: . bé 
Sex: pyc 
Date of Birth: 

Height: 

Weight: 

Hair: 

Eyes: 

Social Security 


Account Number: 
Residence: 


Arizona Driver's 
License Number: 
Father: 


bic 


Employed: 


aan eo 
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i Date of transcription. 2/2/84 


This is a summary of the activity of sd be 


Lion GTE telemail: b7C 


used th ee 
an on telema1l. bé 


b7C 
using the name[ was a member 
of the "Inner Circle,“ and illegal group in the company 
AHSC, and was also an illegal user in a company called 
Raytheon, as ADMIN/SCPP/BANG/PROMO/RAYTHEON. 
is known to have accessed the telemail b6 
system, using one of the above aliases, approximately 62 b7C 
times, from July 7, 1983 to October 3, 1983. 
GTE logs show that | _—__,_lwoula access the be 
telemail system through the dial-up and the 619 area code. b7C 
On October 12, 
b6 
- b7c 
telephone number A search of residence 
also produced an envelope with the above return address. 


on_o x 1983,. _———sitstated to the FBI 6 
that he was on telemail and provided additional 


’ 7 — : BIC 
details of his telemail intrusions. 


Investigation on 1/30/84 a Alexandria, Virginia rie Alexandria 
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Date of transcription. 


On October 13, 1983 was interviewed at 
her place of residence, 
while that residence was being searched by Specia gents AS) of 


the San Diego Federal Bureau of Investigation (FBI) Office pursuant 

to a search warrant signed by U.S. Magistrate J. Edward Harris. DIS 
was advised of the identity of the interviewing agent, 

the nature of the search and the interview, and she voluntarily 

furnished the following information: 


advised that she has been employed at the residence 
since March 21, 1983. She further advised that she lives at the 
residence and that her job is to clean the home and take care of pe 
the seven infants. Stated that she has seen a computer in Bic 
one of the downstairs rooms, however, she has no knowledge as to who 
operates the computer or what is done with it. (She further stated 


that she has never seen anyone operating the computer and that, "I 
only take care of the kids and keep the house clean." 
The interview with[ was conducted in Spanish. b6 
7 7c 


investigation on 


10/13/83 fe ete « SD 196B-1018-27 
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* Date of transcription 41/1/83 
arch was conducted at b6 


in response to a search 


b7c 
warrant Signed by U.S. Nagistrate J. Edward Uarris. A report 
regarding that search has been made. 
nortly after the searchin sents arrived at the loca- 
tion, aL frear old white male named who identi- bé 
fied himself as the brother of was interviewed. bre 
Was at the residence at the search warrant was 
executed. assisted in ident ner individuais in 
the residence at the time. They 
bé 
b7C 
bé 
b7C 
“Zuey were poth at combany, 
puone located in the Mira 
Mesa area of worth _San Diego. stated that his father's 
name was formerly but had ed it to 
for reasons sot Known to the boy. @ said that his b6 
rother, did not iike maintained bic 
the old one. He Said that r equipment 
was located in his bedroom so iar ¢ indicated that 
so far as he knew, his brother had i nocked up to tele- 
phone number In addition QoQ. orher numbers came 
into his home, andl S—~S@Yd 
was asked to identify his brother's com- 
puter friends, and the only person whom he could identify was a bé 
boy named[___]who currently works part-time at Poway High School, bye 


He was aware that his brother "talks" to other friends around the 


country about computer games and specifically mentioned the State 
of Alabama, 
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bre 
CL idessentiaily Stayed _w through- 
out the search of the residence except for room in the 


basement and other basement area rooms. 


h was made of the house and that sketch 
a 


AS c 
tained by the Federal Bureau of Investigation. 
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Date of transcription 11/3/83 
At , Special 
Agents (SAs) identified 


emselves t 


and SA explained to 

at Federal Bureau of Investigation (FBI) agents 
were going to search that residence, and he was emhibited a copy 
or the search warrant. sat Jexplained to him that the items 
to be searched for included a computer and related equipment 

He explained that those items were in his bedroom and he directed 
agents to that location. 


Following that, SAs 
and 
arrived at the residence and commenced searcning. 


was advised that 
i, but his movements 


30 


the bedroom if he 
and he could leave 


sat advised ¥ 
in the unauthorized compute z 
through “hacking”. Lo Jscaces he was 
viewed and he furnished the following inf 

His true given name is inf Ae was 
born of While waS Still oa 
juvenite, his father changed his (the father’s) name cold 
a not know whether that meant his faame was 

ffici h i 


e uses is stil} 


which sells 


His parents own a business known al t—“—SSsYdS 


He stated he does know of people who gain access to com- 
puter systems without authorization, but he does not do so and 
does not even have the equipment to do so. He stated he has no 
mode, but he stated that he_has had access to_one which belongs 
to 


who lives in telephonel_ sid; and attends 
computer classes at UCSD. last used his modem about two 
and one-half weeks ago. has used his modem and has used 


SD 87D-10472 
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BIC 
his computer. He does not think thac[___Jwoula be involved in 
any illegal computer activities such as “hacking". 


SA asked him if he has ever heard of a person who 
uses the name He stated ne has heard of this person bé 


but not lately. He does not think this person is from this area. bIc 
was asked about the name[ Cian again he 
stated hé has heard of this person but has never seen anvt! bE 


“yosted” by him. He nas heard chat anal ~*d b7c 
“pirate” discs, meaning ther copy «discs. 


in connectian 


within 


le has not heard of Search warran 
hackers being served througno the country 
days. He did hear there vas 
there was some sort of 


nich ts a network of 


the ias 


SA asked him again wnere he had 
and he stated ne heard that name on the “Sullet 
a computer system that used 29 SOST messages. Te 
having used that name. 


SA joined the inter wand asked who 
is high school math teacher was. and he stated it was b6 
De 2 


and ie had one by the name of and another one 
He stated he has no t ‘ Triends whe are 
computers. 


SA asked him if 


i 
he has any family in Texas, and 
and has no family in Texas. 


he is interested in conte 
he stated he does not ent 


ou 


At this point ss] awcdtcrarted from the bedroom where b6 
the interview was being conducted and returned a few minutes later pic 
and the interview continued. 


was asked several questions regardin 

tionship to an individual by the name 
Stated that the name 

someone with whom he had attended 


his rela- 


was recalled by him as b7c 
but his 


® Wd 
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recollection of was not clear. Other 1 i were ve 
posed of regarding his relationship > but those 


questions did not specifically pertain to the search nor the 
nauthorized use of Telemail Services. The resuits of the 
questioning regarding[_ shave been set forth in another 
report and are available at the FBI in San Dieso if necessary. 


During the Search of the residence at 

obs rved a pnone located in a 
sitchen area in the b6 
lines were bIG 
rs appeared at 
appeared 


residence. 
active, mumb 
the butte 
as buttons on 


s 


seized was prov 
items seized is av 
items were K 


bic 
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viewed at his residence, 
He was advised as to 

the identity of the interviewing agent and that the interview 

would concern his knowledge and participation in activities, 

now commonly known as “hacking,” into General Telephone Electronics 

(GTE) Telemail System. He was advised of his rights and executed 

awaiver. He furnished the following information. 


be 
b7C 


He has been "hacking" for approximately nine to ten 
months. He has always been interested in electronics and has 


built many electronic kits. Since he was very young, he nas nad 
interest in seeing how things were constructed. It is only of 
recent that he has developed a deep interest in the compurer 
world. 


His present knowledge of computer tecnnolodgy has been 
acquired actually through trial and error. He did attend a 
Regional Occupation Program (ROP) which taught computer 
programing. Due to his background, he ended up as a teacher's 
assistant in that program and was instructing other students. 
His grade average in high school would not be indicative of 


his overall ability. His grade average was low. He explained 
this was caused by him being taken out of school several times 
and traveling in the United States. He has lived in California 


off and on for many years. He has also lived in Alaska with 
his parents. 


His father is self-employed and | —————a | 
He cannot remember 


the exact address, but it is located in the Kearny Mesa area 


of San Diego. The father has five to six employees. The mother ae 
also works with the father. advised that his father's 
name is His father changed his name to 
after seeing it mentioned in a science fiction novel. 
ar reminded of a phone call that occurred 
on October é , wherein he had a conversation with the bé 
interviewing agent. In that conversation, he had told the pre 
interviewing agent that he_was fact 
stated that he was indeed He ha een reluctant 
to reveal this fact to the Federal Bureau of Investigation (FBI) 
ee re ny a V1 A nl | rime SD_196B~1018 
[SPAR Fa : bé 
= ay bIC 
a SA a 11/16/83 
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b7C 


agents who searched his residence on October 13, 1983, pursuant 

to a search warrant. He thought the purpose of the search 

concerned another matter involving the family. He briefly 

described the homicide of an aunt, which had occurred earlier 

in the year. He advised that he now understood the purpose 

of the FBI's presence on the preceding day as well as today. b6 
He decided to use the name or handle[~ TT Jafter calling b7C 
in on a “Bulletin Board.“ One of the cther party's using the 
"Bulletin Board" at the time asked him what his “handle" was, 


Si i 1d not or would not use his own true name, he thought 
of He had heard it used before. 


He has contacted hundreds of individuals on the 


telephone lines by using the computer as the father purchased 

a computer for him approximately nine months ago. The rst b6 
computer terminal that ne had was an Ace 1000. The or name b7c 
was Apple. er computer k Tha NaS 


His purpose in gaining access to varicus 2 
networks in the United States was to learn mcre abou 
He simply would access a system, learn as much as ne. 
it, and then contact the programmers. He frequently 
programmers regarding the system. Many of the discus 
had with programmers regarding the systems concerned 
of security. 


One of the frequent networks that he accessed was GTE's 
Telemail System. He recalled cne account that utilized the GTE 
system as that of Raytheon. He also recalled being furnished 
an administrative vassword called PROMO. He obtained this from 
another “hacker” named This individual w b6 
living in Colorado and frequently used the "Bulletin Board b7C 


a 
had no idea whether as a male or a fe 
Their communication was conducted on a test loop. Conve 
could occur without using any telephone numbers. All th 
to happen was to have individuals call in on the access 
number to the Telemail System. 


Access to these telephone lines usually involved dialing 
the local telephone number for the Telemail System. Once into 
the system, a series of numbers would be dialed and the systems 
"Bulletin Board" would be brought up on a viewing screen. As 
he mentioned earlier, most of his involvement was with the 
Raytheon account. He did access a few others. Most of the 
accounts he accessed were what he called powerless. All an 


1 


V2 
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b7c 


individual could do in that type of account was to send and 

receive mail. There was no ability to create or eliminate an 
account. A message could be added or deleted as wished. On 
occasions, he did access an administrative account. Once identifying 
the parameters of that account, he was able to set up accounts 

of @ lower status. With that type of account, one could simply 

make a private account and furnish it its own access code. 


He stated that he thought the “Bulletin Board” with 
Raytheon was for public use. Anyone could access the system 
with the proper equipment and read it. 


The identities of other “hackers” were discussed wv 
He_advised that he does not know 


The name 


not know 


He denied any deliberate of 
information involved in the computer 
posted on the “Bulletin Board“ ind . 
had become bored and had deleted units from whatever commur 
system they had accessed. He did not ms ts doing any of 
deletions. He advised that he had net cracked the bank computers, 
yet. As far as any other computer networks, ne has simply seen 
on the network to see what it was all about and then had simply 
signed off. 


He wrote a letter to GTE and discussed the lack of 
security with the Telemail System. As he + menticned earlier, 
Telemail had serious security flaws. This letter was written 
circa May of 1983. GTE never responded to his letter. 


As far as the security of Telemail or any other computer 
networks, most of the low level accounts within the system have 
little or no security. Selling of passwords to such accounts 
is common. By experimentation, many of the accounts can be 
accessed simply by using one letter passwords. He has heard 
of a "hacker” or group of “hackers" who make money by selling 
the passwords to the accounts. In fact, some of these “hackers" 
have offered to create an account for a fee. They w i 
money from the Telemail System by creating accounts. 
recalled the group's name as the “time core,” or “pirates cave," 
or “pirates cove." 


b6 
b7c 
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contmasonottrvawot_[ 10/14/83 pmge_4 vs 


b7C 
advised he sold an RCA terminal modem to 
a pawn shop for $170.00. The pawn shop is located in the downtown 
area of San Diego. He could not recall the name of the pawn 
shop. He advised that since he does not have a driver's License, 
he was transported by a friend to the pawn shop so as to make 
the deai. He would not identify nis friend during this interview. 
He advised that he would contact him and obtain the location of 
the pawn shop so as to confirm the sale of the unit. 
b6 
b7C 
by the 
s FLOn ieT. new 
; : 
this to be a government ; in research matters. be 
he was not involved in He: that several BIC 
universities were using the access code 
to get into that system. 
The following daescrintion was obtained from interview 
and observation: 
Name: 
Sex: 
Race: 
Date of Birth: 
Place of Birth: 
Address: be 
. b7¢c 
Education: 
Occupation: 
Hair: 
Eyes: 


Father's name: 


PR us 
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Gate at transcriotion NOVember 2, 1983 


s telephonically contacted at his 
residence, | He was b6 
reminded of a conversation which had occurred between him and b7C 
the writer on October 14, 1983, at his residence. That dis- 
cussion had been preceded by an admonishment of his rights. 

During that discussion, he was questioned as to the Location 
of an RCA Data Terminai, also known as a “modem". 


He advised that he had pawned the "modem" at a pawn- 
shop located in the downtown area of San Diego. He had received 
approximately $170.00 for it. He could not recall the exact 
location of the pawnshop, and he did not have a rece 
the transaction. He added that a friend of his had 
him to the downtown area because he did not have a a 
cense. He would not furnish the identity of this fr 
would contact his friend and obtain the address of t 
so that the sale of the Data Terminal could be confirmed. 


He was now queried as to the results 
with his friend. He stated he had a correction 
his previous interview. He initially said he had sol 
to a pawnshop when, in fact, he had sold it to his friend. His 
friend had returned the terminal to him and was quite concerned 
over the recent publicity concerning the searches that occurred b6 
throughout the United States. The friend no longer wished to be b7c 
involved with him. area aid that he would voluntarily turn 
the “modem" over to the investigating agent, and that it could 


be picked up at his residence during the afternoon of Octoner 17, 


inguiry 
e regarding 
the “modem" 


1983. 
At approximately 1:15 P.M., the RCA "modem", Serial 
Number 001034, Model Number UP3501, along with a smail power 
up at the b6 


supply and asserted connecting cables, was picked u 


He commented at this time that he had been told by 
friends to seek the assistance of an attorney and discuss the 
facts regarding his involvement in the illegal entry into the 
Telenet Computer System. As of yet, he had not retained counsel 
and queried the writer as to what he should do. He was reminded 


imesvgnvon on OCtober 17, 1983, [> ,,,, $2 196B- 1018 


be 
b7c 


October 18, 1983 


This document contains neither recommendations nor conciusions Bt and is joanea to your agency: 
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b6é 
2 
Continuation of interview of es | -~ 10/17/83 bIC 


. Page = 


of his previous interview with the writer wherein he had been 
advised of his rights, including the right to counsel. He was 
told the decision was his to make. He then asked what he should 
do in the event the news media contacted him regarding his par- 
ticipation in the computer fraud. He was advised by the writer 


that any contact or discussion with the media would be left as 
his prerogative. 


at rei/D0s 
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10/31/83 bé 
b7c 


tele- b7D 
phone | was advised of the entity of the interviewing 
agent and that the interview concerned an investigation involving 


the penetration of the GTE-Telenet/Telemail Computer Network. 

advised he had information concerning this matter and requested 
that his identity be protected and that the information furnished be 
kept confidential. po SS rurnished the following information: 


Oate of transcription, 


D6 
b7C 


be 
bic 
bID 


= 7) 

wnvesinvonon 20/23/83, [TO 82 1968-1028 -" 
ter Qo oat b6 

: i bic 

. so sat dees apr tfv09 


‘This document containg neither cecommendatians nor conclusions at tha FAN, It is the oF 
it ang its contents are notue be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of teanseription_ 10/24/83 


be 
b7C 
b7D 


telephone who was advised of the identity of 
the interviewing agent and the purpose of the interview, provided 
the following information: 


bé 
b7c 
b7D 


bé 
b7c 


b6 
b7c 
b7D 


11, 34 
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i Date of transcription 3 / 20 / 8 3 
hereinafter referred 
to as 
hereinafter referred to as were interviewed 
at the offices of Home Federal Savings and Loan, 12411 Poway b6 
Road, Poway, California. They were being interviewed at BIC 
the re b7D 
reside at telephone 
Formation was furnished by 
b6 
b7C 
b7D 
b6 
bIC 
bID 
be 
b7c 
bID 
b6 
b7C 
b7D ¢ 
tavestigation on 9/8/83 rite SD_SID~/OY7Z 
bIC 
al 
by SA 9/16/83 oe 
. , — 146 B-f1¥— pofe 
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Date of transeription__ 2/0/84 


This is a summary of the activities of Cd 
[Jen cre Telemail. 


b6 
used the names[——] Bre 
and on Telemail. 
was an illegal user in the following companies: 
BMW, MARAVEN and UAW. bé 
: . bIC 
LC  Jaccessea Telemail at least 40 times between 

July 10, 1983, and October 9, 1983. 

Records of bIE 
b6 
b7e 

has admitted to the FBI that he did access b6 
the Telemail system without authorization and was using b7c 
the above-mentioned names. 
Investigation on 2/6/84 at_ Alexandria, Va. enehlexandria 2064-633 
wy SAL ga Date dictatea, 2/6/84 Pe 
This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
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L 2/10/84 


Date of transcription, 


This is a summary of the activities of Ll b6 


Co Jen GTE Telemail. bIc 
ee the namel——————sdon GE Telemail. 
He was a m er of a group known as the INNERCIRCLE and bé6 


was an illegal user in the legitimate customer AMERICAN b7e 
HOSPITAL SUPPLY COMPANY (AHSC).[______——ijleft: four messages ~ 

on GTE Telemail between the dates of August 15, 1983, 

and August 19, 1983. 


has admitted to the FBI that he used 
the Telemail services four or five times, but did not 


° r bé 
think that someone else was being charged for the computer bic 
time. stated he thought that when someone contacted 
COMPUSERV or the source, then charges would begin to accumulate. 

2/6/84 | Alexandria, Va. Alexandria 2868-633 
lnvestigation on. at File # 
(764 
saa 2/6/04 bs 
Dy, ga3 Date aictated. f6/ b7C 
This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency: 
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Date of transcription__1/30/8 4 


be 


elephone ni er was advised of bic 


the official identity of the interviewing agent and thereafter 
provided the following information: 


He used the name [oar the Osuny bulletin 
board during the summer of 1983. While looking at messages 
on this bulletin board, was able to see a private 


message left for another party on that board. This message b6 
was from someone using the name and the message b7C 


stated something to the effect _ _ can call me at 
- aia he called the number once 
to see if it was a working number and a male answered. 


said he did not say anything, but simply hung 
up. 


also said that at an electronics show 
in New Jersey he met_a computer enthusiast whose first 
name was poe ee gaia he uses the name on b6 
the Telemail system and that he would leave bic 
a welcome message on Telemail for 


said he used the Telemail service 


approximately four or five times and in doing so communicated b6 
with who hi fir p7C 
and 


[further stated that he did not know 
that the messages he was leaving on Telemail were being 


billed to another company. He thought that somehow this reo 
was an electronic connection to a Source account or a 
Compuserve account and that a person would be billed through 
Source or Compuserve once you have connected with those 
computers. 
also provided the following identifying 
information? 
bé 


Date of Birth: bIC 
Age: 


Social Security 


Account Number: | 


investigation on 1/25/84 at Alexandria, Va. rieM@lexandria 196A-633 

b6 
> SAD a ontecttaea___1/26/84 pre 
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Height: 
Weight: bé 
Eyes: b7c 
Hair: 


WV 
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pate of tranteription_ 2/10/84 
This is a summary of the activity of _—id 


Co Jon GTE Telemail. bé 


b?. 
[__]usea the names[Jana[ . 
[Jen Telemail. 


was a member of the group known as the 
PHALSERS and was registered illegally as a user in the 
following companies: BMW, UAW, MARAVEN, TELENET and AHFS. 


bé 
. . b7C 
left six messages on Telemail between 
July 26, 1983, and August 9, 1983. 
A fellow “PHALSER" told the_FBI that 
is the same person who uses the name on various 
computer bulletin_boards. A list_of hackers seized from 
the residence of be 
contains the listing: bre 
This phone number is the unlisted phone number for 
CF also known as aise 
said he saw a message on a computer bulletin board statin 
thatl ~~ Jeould be reached at the nunber| | 
The customer_name and address for that unlisted one 
at a 
LC was contacted at that number 
d_ th he is th tual b 
bé 
b7C 
at this number, but denies being 
or using the Telemail system. The personal ID 
of on Telemail was 
A fellow PHALSER states that CO works in 
“some sort _of informational job, reading stuff over the bé 
i k £ bic 
NCIC check onL___]revealed three past arrests b6 
and one conviction as follows: BTC 
46a 
investigation on 2/6/84 at Alexandria, Va. rieAlexandria 28BA-633 
Sub FP 
bé 


oy SAD 8 Date dictates 2/6/84 BIC 
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Date of transcription_1/27/84  —__ 


was CSISpROnTGaTIF a = = 
of the official identity of th iewing agent and 


the purpose of the interview. [ ____] thereafter rovided 
the following information. His date of birth is 


and i oved a 


b6 
b7C 


has two telephone 
numbers, Both of these 


Ss have a customer name and address C5 
indicated Ruth Benedict was his mother who is now 
oJ 


ceased, 


stated he has a home computer and a modem 


and a_printer. He runs a hdime bulletin board known as 
the The number to call to contact the b6 
computer was until approximately July 1, 1983, bie 
when he switched the modem number tol 


also has a post office box number that 
he gives out to computer enthusiasts because he does not 6 


want to sive out his home address. That is,[——=idS bic 


During July and August, 1983,. —sidiwas setting 
up his bulletin board to accept incoming calls and requested 
assistance from a friend of his named 


6 
7c 
number is|—————Sd'sS§and = according to 
has a computer system, a modem, and a printer. 
said_he does not know who 6 
or are.[ __—sdidenied any involvement in bre 
any illegal intrusions into GTE telemail or any other illegal 
Sue ? 
investigation on__ 1/12/84 a Alexandria, Virginia rie » Alexandria 
196A-633 
ee, owe sews__1/1384 bs 
BIC 
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activities with his computer system. Cate denied 
any involvement with the illegal use of the IBM ADS Voice 
Message System. 


did, however, state that h ived 
num alls at the telephone number asking 
for He said these phone callis began during 


the summer of 1983, and the most recent was approximately 
ene month ago. . 

During the summer of 1983,[ —sdjremembers 
getting a phone call from someone who identified himself 
as This person talked with an apparent nasal 
condition, doing much coughing and_blowing his nose and 
snorting during the conversation. Co called long 
distance tol and asked him for a password for his 
bulletin board. 


stated he had had some difficulty with 
the telephone company during the past few months and that 
he received an additional number from the Chicago Phone 
Company and due to an oversight by the phone company, had 
not been billed for this number for approximately six months. 
This number, is the number he presently uses 


for his computer, and further stated that he eventually 


had to pay the phone company an additional sum of monev 
for phone calis made over the past six months or so. 


LJ aoes some work at the Chicago Library 
Radio Station reading newspaper articles over the air for 
the blind. This station is known as "CHRIS," which stands 
for Chicago Radio Information Systems. The eer mes 


between this acronym "CHRIS" first name of 
Co was commented on by 


said he did not know and had never heard 


of the names 

and others. said he did have a book of 
user names and true names concerning his home bulletin 
board and he may have a list of nationwide home bulletin 
boards on which he wrote the true names of some computer 
enthusiasts. CJ saia that he would be willing to 
make this information available to the FBI. 
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NAME OF DEFENDANTS: 


Race oe 

eX 6 

Date of Birth C]* bé 
Height pyc 
Weight 

Social Secuniy 

Account Number 
Address 
peer 


\a1 
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Date of Birth 
‘Wergne 
Weight 
Address, 


\at 


af 
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3. (Fees rive as 


Race. 

~Sex7 
Date of Birth 
Height 
Weight 
Home Address 


\t4 
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Race t 
JSex 3 J b6 
Date of Birth =” Cy BIC 

Height 

Weight 

Home Address 


ap 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 


matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in this matter. 


2. On October 12, 1983, the premises located at 


searched pursuant to a duly authorized court order and 
various computer paraphenalia were seized. 


b6 
bIC 
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WITNESSES: 


i 
. elemal 


8229 Boone Boulevard 

Vienna, Virginia 

relepnone [J 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


bic 


2. bs 
Special Agent BIC 


3. 


4a. 


Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent 


Federal Bureau of Investigation, Albany bé 
b7e 

Special Agent 

Federal Bureau of Investigation, bé 
b7C 


Buffalo, New York 


can Suppl details concerning search ofl sid 
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EVIDENCE: 


| 


1. Summary of messages left on Telemail b 


GTE Telemail). 


2. Summary of messages left on Tetenpi by LCL] 


Co }Jloriginals in possession of 


+ —_ of “eens seyees in search ofl sd 


4. Summary of relevant evidence maintained by FBI 
Alexandria. 


5. Summary of trap and trace records received from 
originals at Far Alexandria). 
6. List of charges attributed to 
andl =i (corriiginals with . 
xe: [7 Jang 
le Swita of messages left on Telemail byl sd 


(originals with ye 
2. Summary of evidence retained by FBI Alexandria. 


3. Copy of_incident report from Nazareth College 
which implicates 


4. Summary of nine messages left on Telemail by 
[TT Jeoriginals wien 

5. Co: of trap and trace documents provided by 
ee keriginal with FBI Alexandria). 

6. List of charges attributed tof i aka 
[TF and Paka original wren? 
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1/9/84 


‘Date of transcription. 


The following is a_summary of messages left 
by the illegal user known sf dena] 
[Jon GTE Telemail. The date and time of each message be 


is provided, with a synopsis of particularly significant pre 
messages included. 


1.) August 30, 1983, 6:14 PM {all times Eastern 
Daylight Time}. 


2.) August 30, 1983, 9:07 PM. 
3.) August 31, 1983, 11:02 AM. 
4.) August 31, 1983, 9:02 AM. 
5.) August 31, 1983, 3:54 PM. 
6.) September 1, 1983, 7:48 AM. 
7.) September 1, 1983, 8:04 AM. 
8.} August 31, 1983, 7:54 PM. 


Note, on September 1, 1983, at 11:03 AM, the 


illegal user received a message from the illegal 

user (aka . This message states 

in part, "He wrote me and told me that if I don't set 

up accounts a certain way then the company will notice b6 
when the bill_comes and they will drop the_accounts." In b7c 


this message[ sis clearly tellingl _—laka 

that these messages are being placed in the account 
of a company without that company knowing about it and 
approving of it and further the company will be billed 
for the message. 


9.) September 2, 1983, 12:10 PM. 
10.) September 5, 1983, 7:07 PM. 


1l.} September 6, 1983, 11:38 AM. In this message 
[-—asteis tol dis the true name of |] > 


wife. b7C 


investigation on__L 2/8/83 «Alexandria, Virginia rueflexandria 196A-633 
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12.) September 6, 1983, 3:58 PM. 

13.) September 7, 1983, 11:10 AM. 

14.) September 7, 1983, 1:59 PM. 

15.) September 7, 1983, 2:32 PM. 

16.} September 8, 1983, 7:49 AM. 

17.) September 8, 1983, 6:12 PM. 

18.) September 11, 1983, 6:34 PM. 

19.) September 11, 1983, 6:35 PM. 

20.) September 12, 1983, 11:27 AM. 

21.) September 12, 1983, 1:56 PM. Message 
refers in part to the purchase of oxygen. This message 
is in response to a message left on the system — 
stating that the oxygen was ready for pick-up at Rochester 
Fire and Safety. Investigation by the FBI at Rochester 
Fire and Safety reveals chat (eee in 
fact, pick up a respirator on September 12, 1983. 

22.) September 13, 1983, 7:33 AM. 

23.) September 15, 1983, 9:04 PM. Message 


states in part "I was unable to log into Telenet, til 
now. The lines were busy all day. I don't know what 


all the action was for on Telenet, but it looks like everyone 


was doing there last minute business reports today.” 


24.) September 16, 1983, 8:00 AM. Message 
reads in part “I check the Lincom board this morning, 
and much to my surprise I found nothing of: use and/or 
value. I think that you should pass alont (SIC) to the 
Admin, that we need support here in the field, and the 
board should contain important information dealing with 
the everyday usage of this system." 


25.) September 18, 1983, 10:01 AM. Message 
states in part from the Okla, sales office has made 


national news. He was in one of the maq's this month.” 
This statement refers to the fact chat 
akal was quoted in a national computer magazine 


in an article concerning computer hacking. 


a3" 


\a5 
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26.) September 18, 1983, 10:21 AM. 


27. September 18, 1983, 4:07 PM. Message 
refers to akal fis 6 
the roommate of lat Cornell University. pie 


28.) September 19, 1983, 9:32 AM. 
29.) September 21, 1983, 7:45 PM. 
30.) September 21, 1983, 7:44 PM. 
31.) September 23, 1983, 9:03 AM. 
32.) September 23, 1983, 5:12 PM. 
33.) September 22, 1983, 2:31 PM. 
34.} September 23, 1983, 5:18 PM. 
35.) September 24, 1983, 5:29 PM. 


36. September_25, 1983, 9:19 AM. This message 
refers tol} meaning) wifes 8S 
37.) September 26, 1983, 3:55 PM. 
38.) September 26, 1983, 1:52 PM. 
39.) September 27, 1983, 3:00 PM. , 
40.} September 27, 1983, 6:27 PM. 
41.} September 28, 1983, 11:44 AM. 
42.) September 28, 1983, 11:33 AM. 
43.) September 28, 1983, 4:39 PM. 
44.} September 30, 1983, 8:35 AM. 
45.) October 2, 1983, 12:27 PM. 
46.) October 2, 1983, 12:23 PM. 


47.) October 2, 1983, 3:47 PM. This message bé 
again refers tol} meaning) BS 


roommate at Cornell. 


aT \Ay 
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48.) October 2, 1983, 3:55 PM. This message 6 
states "The A/C you know the number isl sd (Subscriber j.., 
to number is unknown.) 

49.) October 3, 1983, 6:22 PM. 

50.} October 3, 1983, 1:13 PM. 

51.} October 3, 1983, 4:34 PM. 

52.) October 4, 1983, 1:50 PM. 

53.) October 5, 1983, 10:24 AM. 

54.) October 5, 1983, 10:26 AM. 

55.} October 5, 1983, 3:41 PM. 

56.) October 6, 1983, 12:39 PM. ‘This message 
states in part “How about that for balls, giving a story 
like I did to Well, it would have been 
nice if it had worked though." This statement refers bE 
to the message left by jon October _5, 1983, at bIC 
3:41 PM, wherein he states he talked to 
at American Community and told the faise story 
that he was doing a story on companies like American 
Community. was attempting to get information about 
decoders or descramblers for cable t.v. systems. 

57.} October 6, 1983, 12:41 PM. 

58.) October 6, 1983, 6:12 PM. 

59.) October 7, 1983, 8:16 AM. 

60.) October 6, 1983, 6:51 PM. 

61.) October 6, 1983, 7:40 PM. This message 
states in part "The cable company there is semi~smart. 
I will have to work on to find out what type pe 

c 


of decoder system they are using. I think that I could 
get the info, but if I don't you can't go wrong with sine 
wave." 

62.) October 7, 1983, 4:22 PM. 

63.} October 10, 1983, 4:49 PM. 


64.) October 10, 1983, 4:47 PM. 


al 
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65.) October 11, 1983, 11:01 AM. 
66.) October 11, 1983, 1:11 PM. 


67.) October 11, 1983, 1:05 PM. 


\b 
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date of transeription.__ 1/9/84 
The following is a_summary of messages left 
by the illegal user known as and 
on GTE Telemail. The date and time of each 
message is provided, with a synopsis of particularly significant 
messages included. 


bé 
b7c 


1.) August 30, 1983, 7:19 PM (all times Eastern 


Daylight Time). This mes ain. h name[ | be 
and is signed "Love is the true 


aka and 
2.) August 31, 1983, 10:23 AM. This message bé6 
also contains the true name[____] pyc 


3.) August 31, 1983, 10:24 AM. 
4.) August 31, 1983, 2:23 PM. 


5.) August 31, 1983, 3:38 PM. 


6. September 1, 1983, 10:57 AM. This message 
is from She has now changed her user name from bE 
pTc 


7.) September 2, 1983, 11:54 AM. 


8.) September_5, 1983, 12:05 PM. This message - bé 
again has the true name[ ___] bye 
9.) September 6, 1983, 9:16 AM. 
10.) September 6, 1983, 9:22 AM. 
ll.) September 6, 1983, 11:14 AM. 
12.) September 6, 1983, 12:43 PM. 
13.) September 6, 1983, 1:31 PM. 
14.) September 7, 1983, 2:17 PM. 
12/8/83 Alexandria, Virginia exandria 196A-633 
investigation on at Fie @ 
. bé 
o sal fsa onte sates 22/8/83 BTC 
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15.) September 8, 1983, 9:16 AM. 
16.) September 8, 1983, 1:44 PM. 
17.) September 8, 1983, 1:52 PM, 
18.) September 9, 1983, 9:03 AM. 


19. September 12, 1983, 12:32 PM. This message 
is from tol Jand is as follows "I do 


believe that I told you to expect quite a bit higher than 
you were but I must admit that that is even higher than 

I thought. Also Roch Fire and Safethy (SIC) called and 
said that the 02 is ready and the balance due is $164." 
Investigation by the FBI at_a firm called Rochester Fire 
and Safety indicated that did, in fact, 
have an order for a respirator and that e balance due 
was sie4.L | picked up that respirator on September 
12, 1983. 


20.) September 12, 1983, 3:24 PM. 
21.) September 12, 1983, 3:08 PM. 
22.) September 16, 1983, 12:48 PM. 


23.) September 17, 1983, 9:55 PM. This_message 
contains the true banel lane is signed Love, 


24.) September 18, 1983, 1:21 PM. 


25.) September 19, 1983, 10:21 AM. This message 


asks “How does feel about your little discovery (rebooting 


his system)? If he's anything eg aa it_is probably 
a_ little unsettling." These names refer_to 

roommate at Cornell, and 

husband. 


26.) September 19, 1983, 10:23 AM. 


27.) September 19, 1983, 2:31 PM. 


28.) September 20, 1983, 10:02 AM. 
29.) September 20, 1983, 10:09 AM. 


Bro 


b6 
b7c 


b6 
bIC 


b6 
b7¢c 
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30.) September 
31.) September 
32.) September 
33.) September 
34.) September 
35.) September 
36.) September 
37.) September 
38.) September 
39.) September 
40.) September 
41.) September 
42.) September 
43.) September 
44.} September 
45.) September 
46.) September 
47.) September 
48.) September 
49.) September 
is tol jana uses the 
50.) September 
Sl.} September 
52.) September 


20, 1983, 11:38 AM. 
20, 1983, 3:46 PM. 
21, 1983, 2:59 PM. 
22, 1983, 11:13 AM. 
22, 1983, 2:53 PM. 
23, 1983, 10:23 AM. 
23, 1983, 11:33 AM. 
23, 1983, 2:41 PM. 
26, 1983, 9:17 AM. 
26, 1983, 9:17 AM. 
26, 1983, 9:25 AM. 
26, 1983, 9:41 AM. 
26, 1983, 10:51 AM. 
26, 1983, 12:06 PM. 
26, 1983, 3:32 PM. 
26, 1983, 5:48 PM. 
27, 1983, 4:19 PM. 
27, 1983, 7:23 PM. 
27, 1983, 4:11 PM. 
nanel—f referring tolo BE, 
28, 1983, 11:55 AM. 
29, 1983, 6:27 PM. 


30, 1983, 8:58 AM, 


be 


9.0\ 
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October 1, 1983, 3: PM. This message 

to to her husband 

. The message reads in part "Well, I finally b6 
got throug! I didn't know your name. I had forgotten 7c 
what you_had said it was. You really ought to investigate 

on that[__ user on here. Who knows, with your hacking 

ability you may come up with something interesting." 


54.) October 2, 1983, 1:37 PM. 
55.) October 2, 1983, 6:38 PM. 
56.) October 3, 1983, 9:44 AM. 
57.) September 30, 1983, 8:58 AM. 
58.) October 2, 1983, 1:29 PM. 
59.) October 2, 1983, 1:42 PM. 
60.) October 2, 1983, 6:34 PM. 
61.) October 3, 1983, 9:37 AM. 
62.) October 3, 1983, 3:26 PM. 
63.) October 3, 1983, 3:29 PM. 
64.) October 4, 1983, 11:12 AM. 
65.) October 4, 1983, 2:42 PM. 
66.) October 4, 1983, 11:23 AM. 
67.) October 5, 1983, 3:47 PM. 
68.) October 6, 1983, 1:16 PM. 
69.) October 6, 1983, 1:07 PM. 
70.) October 10, 1983, 2:41 PM. 
Ji.) October 10, 1983, 5:54 PM. 


72.) October 7, 1983, 3:25 PM, 


Qos 
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73.} October 11, 1983, 1:46 PM, 


74.) October 11, 1983, 3:08 PM. 


203 


FEDERAL BUREAU OF INVESTIGATION 


ate of transeription_ 10/19/83 


Pursuant to a search warrant, a search was 
conducted at The premises were 
entered at 9: a.m. and exited at 10:52 a.m. 


b6é 
b7c 


The following items were taken from the residence 
and receipted for: 


1. Manilla folder with tapes, computer 
printouts and miscellaneous items from cabinet in 
garage - all computer related. 


2. Hayes Smart Modern 300, 552094725 


3. Radio Shack_TRS 80, Model 3, SSAN (SOcial b6 
Security Account Number)[_ Jon it. pic 
4. Power source Hayes, lead 
5. Two disc drives 
a) Tandon 100-1 
b) Sugart SA-400 
6. printer Gemini 10x 3013024363 
7. Flip-N-File Programs 
8, Digital timer - Sony 023702 
9. Columbia Stereo amplifier 
10. SPR-4 - Drake Manuals (two) 
10a. Miscellaneous documents fron[l___—its 
11. Printout paper 


be 
bIC 


= 
AX G4 CEG 


10/12/83 | suLtate—196aSi9— 


10/13/83 


Date dictated, U2 TZ Se 


investigation an. 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the F umd ®toaned to your ap. <5: 
“* wnd itt contents are not to be distributed outsiae your agency. . 
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FEDERAL BUREAU OF INVESTIGATION 


i 12/7/83 


Date of transcription 


The following is a review of evidence seized pursuant 


to a duly authoriz F the 
premises known_as the b6 
residence of b7C 


The following is a summary of evidence relevant te 
this investigation: 


1) Two yellow cards with the printing b6 
b7c 


2) A printout with the words, "Computer located at," 
and six phone numbers listed. 


3) A printout with numerous bulletin boards and phone 
numbers associated with those bulletin boards. 


4) A white piece of paper with numerous numbers of 
unknown meaning on it. 


investigation on__ 41/15/83 at_Alexandria, Virginia rie» Alexandria 196A-633 

b6 
»y_ Sal oF: mb one sictateg__11/16/83 bre 
This document contains neitner recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


1 Date of transcription. 1/20/84 

The_flo discs seized in the search of the 
residence of 
were_examined by a computer programmer, : bé 
and Istated no information pertaining to GTE Telemail b7c 
was found. 

1/17/84 Alexandria, Va. Alexandria 196A-633 

Investigation on. at File # 


. be 
| 556) ontescratea__ 1/1778 4 bre 


This document contains neither recommendations nor conclusions of the FBI. it is the property of tne FB! and is (oaned to your agency; 


it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


x 1/27/84 


Date of transcription 


The following is a review of 


b6 
and trace information receive 


bIC 
BIE 


be 
bic 
BIE 


b7E 


b6 
b7C 


1/19/84 Alexandria, Va. Alexandria 196A~-633 
investigatian on at Fite # 


. sal} wyis/es BE 


Date dictated p7c 


This document contains neither recommendations nor conclusions of the FBI. it is tne property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Date ut transeription__1/ 31/8 4 


On January 24, 1984, 

Ct GTE-Telemail, provided a copy of the amount of money be 
ost by GTE Telemail from the unauthorized use by the hackers. b7C 
This document is broken down by user and by company. - 

Many of the hackers had two or more user names; 

therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company}: 


USER COMPANY AMOUNT. 
UAW a0 
: b6 
Cy Maraven $L6.00 p7c 
Telenet $128.90 
$127.58 


| CBOT $2.90 September b6 
b7c 
| | RADA $1.00 September 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July 6 
b7C 
Telenet $151.00 August 
seat TL] 
Investigation on 1/25/84 a Alexandria, Virginia rue e Alexandria 196A-633 
b6 
by SA sfk pate cictatea_1/25/84 nc 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not ta be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


1/9/84 


Date of transcription 


The following is a summary of messages left 
by the ijlegal user[ dan be 
pos ‘Jon Gre telemail: prc 
The date and time of each message is provided 


with the synopsis of particularly significant messages 
included. 


1.) August 30, 1983, 12:56 AM {all times Eastern 
Daylight Time). This message discusses how to set up 
illegal user accounts. 


2.) August 30, 1983, 4:19 PM. This message 
states "Hil _} I got our new accounts up.[__—iwill 
never find these. (1 hope) Tell[ that her account 
is ready i " 

refers to 
is the illegal user name for 


her password on the Telemail System. a 
3.) August 30, 1983, 8:20 PM. This message 
tells| how to use the Telemail System. 
4.) August 30, 1983, 10:54 PM. 
5.) August 30, 1983, 8:18 PM. 
6.) August 30, 1983, 4:18 PM. 
7. August 31, 1983, 12:56 PM. This message b6 
refers to b7c 
8.) September 1, 1983, 3:18 PM. This message 
reads as follows I got a list of RADA accounts and 
yours were there too. So that does not seem to hide them. 
Also,[___Jis set up strangely in that you can only use 
certain configs. Please explain. My accounts are under bsé 
RADA, even though there are only a few. I frankly think B7e 


[jis dangerous, since does not have a particularly 
good reputation, and saying is run yD wid 


be sure to get it looked at if anything is looked at. As 
of now, accounts (if etc.) are 


12/8/83 


investigation on. a Alexandria, Virginia rine ghlexandria 196A-633 


b6 


> —__sa[ ga ont aicotes___ 12/8/83 BIC 
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under RADA. If you get a list of_RADA accounts ou also 
get some that maybe you created etc.). 
I have not looked into it but if those are_under 


they are also showing up under_RADA since[_ lis a subset 
of source. Will call you. " 


9.) September 1, 1983, 4:44 PM. Message reads 
as follows Ld I don't know what you are trying to find 
out (i.e. your findings) but the other accounts are: 

There is nothing wrong 


with the accounts, but_if you find_anything, let me know. 
es under[——} and is under RADA, 

a others of mine are under RADA. P.S. call me 
when you get in, if busy try again in five. See ya . 


10.) September 1, 1983, 4:48 PM. 


11.) September 1, 1983, 10:14 AM. This message 
reads in part "Send me mail with the options for the "Admin 
not noticing." This message refers to continuing attempts 
to keep the legitimate administrator of an account from 
knowing there are hackers in his company's account. 


12.) September_], 1983, 8:47 AM. This message 
refers to the fact that as_the administrator 
is going to change the user name of to 


13.) September 1, 1983, 11:21 AM. 


14.) September 1, 1983, 11:03 AM. This message 
reads as follows as you can see, your name has been 


changed_to its proper name (also, please send mail to 
me to » I finally got it I think. And hopefully 
won't screw us up again. He wrote me and told 


me that if I don’t set up accounts a certain way then 

the company will notice when the bill comes and they will 
drop the accounts. I think he is bullshitting me because 
he wants to have full control of the system. Oh well 

I told him to tell me what the correct set up params are 
so I can do it. Talk to you later 


15.) September 1, 1983, 5:19 PM. 
16.) September 6, 1983, 8:37 AM. 


17.) September 5, 1983, 3:29 PM. 


Aly 


be 
b7c 


be 
b7c 


b6 
b7c 


b6 
bIC 
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18.) September 5, 1983, 8:24 PM. This message bb 
contains the name b7c 

19.} September 4, 1983, 11:02 PM. 

20.) September 6, 1983, 10:54 AM. 

21.) September 5, 1983, 3:27 PM. This message 
contains the sentence "I just got back (3:19) andl be 
(my roommate) just walked in.* This sentence indicates BIC 
that is the illegal user name for his roommate, 

22.) September 6, 1983, 3:41 PM. 

23.) September 6, 1983, 6:02 PM. 

24.) September 6, 1983, 6:03 PM. 

25.) September 6, 1983, 6:04 PM. 

26.} September 6, 1983, 6:09 PM. 

27.) September 7, 1983, 12:41 PM. 

28.) September 7, 1983, 12:50 PM. 

29.) September 7, 1983, 4:36 PM. 

Note, on September 7, 1983, at 2:14 PM, 
received a message from[ __} This message begins 
Gee, & a first time. In this be 

uses the true first name bic 


This message also refers to[ _| meaning 


30.} September 8, 1983, 8:44 AM. 
31.} September 7, 1983, 11:42 PM. 
32.) September 7, 1983, 11:37 PM. 
33.) September 8, 1983, 10:52 AM. 


34.) September 8, 1983, 10:44 AM. In this 


messa pl _ieses the name[_—siieferring tol _—idi a 
} aka 


AS 


FEDERAL BUREAU OF INVESTIGATION 
FOI/PA 

DELETED PAGE INFORMATION SHEET 
FOI/PA# 1325219-0 


Total Deleted Page(s) = 65 
Page 17 ~ b6; b7C; b7E; 
Page 18 ~ b6; b7C; b7E; 
Page 19 ~ b6; b7C; b7E; 
Page 20 ~ b6; b7C; b7E; 
Page 21 ~ b6; b7C; b7E; 
Page 22 ~ b6; b7C; b7E; 
Page 23 ~ b6; b7C; b7E; 
Page 24 ~ b6; b7C; b7E; 
Page 25 ~ b6; b7C; b7E; 
Page 26 ~ b6; b7C; b7E; 
Page 28 ~ Duplicate; 
Page 29 ~ Duplicate; 
Page 30 ~ Duplicate; 
Page 31 ~ Duplicate; 
Page 45 ~ Duplicate; 
Page 46 ~ Duplicate; 
Page 74 ~ Duplicate; 
Page 75 ~ Duplicate; 
Page 76 ~ Duplicate; 
Page 77 ~ Duplicate; 
Page 79 ~ b6; b7C; b7E; 
Page 80 ~ b6; b7C; b7E; 
Page 83 ~ Duplicate; 
Page 84 ~ Duplicate; 
Page 85 ~ Duplicate; 
Page 86 ~ Duplicate; 
Page 87 ~ Duplicate; 
Page 88 ~ Duplicate; 
Page 89 ~ Duplicate; 
Page 90 ~ Duplicate; 
Page 94 ~ Duplicate; 
Page 95 ~ Duplicate; 
Page 121 ~ Duplicate; 
Page 122 ~ Duplicate; 
Page 123 ~ Duplicate; 
Page 124 ~ Duplicate; 
Page 131 ~ Duplicate; 
Page 132 ~ Duplicate; 
Page 141 ~ Duplicate; 
Page 142 ~ Duplicate; 
Page 143 ~ Duplicate; 
Page 144 ~ Duplicate; 
Page 159 ~ Duplicate; 
Page 160 ~ Duplicate; 
Page 178 ~ Duplicate; 
Page 179 ~ Duplicate; 
Page 180 ~ Duplicate; 
Page 181 ~ Duplicate; 


Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 


189 
190 
191 
192 
193 
202 
203 
204 
205 
206 
207 
213 
214 
215 
216 
217 
218 


Duplicate; 
Duplicate; 
Duplicate; 
Duplicate; 
b6; bIC; D7E; 
Duplicate; 
Duplicate; 
Duplicate; 
Duplicate; 
b6; bIC; b7E; 
b6; b7C; b7E; 
Duplicate; 
Duplicate; 
Duplicate; 
Duplicate; 
b6; b7C; b7E; 
b6; b7C; bTE; 
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35.) September_8, 1983, 3:21 PM. Thi 
again uses the true name[___in referring tol] 
36.) September 9, 1983, 8:32 AM. 
37.) September 12, 1983, 12:40 PM. 
38.) September 12, 1983, 4:34 PM. 
39.) September 12, 1983, 9:28 PM. 
40.) September 13, 1983, 10:13 AM. 


41.) September 15, 1983, 1:45 PM. This message 

states "Well I figured out what[ —Jaia, and I found his 

new board. It is on this. (a different company). We (not 

him) are now under Lincom, a division I created, so_we 

are isolated (a little) from both the main co. and 

Talk to you later, " This message indicates 
has set up his_own illegal node in a new company, 

and were previously illegal 

users in the legitimate user known as RADA. 


42.) September 15, 1983, 1:43 PM. 

43.) September 16, 1983, 1:56 PM. This message 
ref Pat (indicating his roommate[ 
and (indicating . 

44.) September 16, 1983, 1:05 AM. 

45.) September 16, 1983, 2:03 PM. 

46.) September_18, 1983, 1:28 AM. This message 
again uses the true name[_ ana the true name 

47.) September 18, 1983, 1:36 PM. 

48.) September 18, 1983, 11:17 AM. 

49.) September 19, 1983, 1:39 PM. 

50.) September 20, 1983, 8:46 AM. 


51.) September 20, 1983, 10:23 AM. 


Alle 


be 
bIC 


be 
b7¢ 


beé 
b7c 
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52.) September 20, 1983, 10:38 AM. 
53.) September 20, 1983, 11:18 AM. 
54.) September 20, 1983, 3:46 PM. 
55.) September 20, 1983, 2:29 PM. 
56.) September 21, 1983, 7:33 PM. 


57.) September 22, 1983, 10:20 AM. This message 
states in part "Who knows, anyway_we have been terrorizing 
the parking lot with the laser. window has a good 
view of the parking lot, so we just aim it at peoples 
feet and they can’t figure out what the hell is going 
on. The beam does diverge a little, for example, at 200 
yards or so, it is about five inches wide. But it still 
gives a good effect." 


be 
bICc 


58.} September 22, 1983, 10:35 AM. 

59.) September 22, 1983, 9:03 PM. 

60.) September 23, 1983, 3:56 PM. 

61.) September 24, 1983, 6:06 PM. 

62.) September 26, 1983, 12:30 PM. 

63.) September 27, 1983, 12:29 AM. 

64.) September 27, 1983, 12:32 AM. 

65.) September 28, 1983, 12:31 PM. 

66.) September 29, 1983, 12:56 PM. This message 
states Lid it looks like we had to nove-[-—}is[- b6 
and can be sent mail. is password: Bright. pie 
Talk to you later. “This indicates that these 
illegal users have now moved to yet a third company, 3M 
Corporation. 


67.) September 29, 1983, 2:58 PM. 


68.) September 29, 1983, 3:11 PM. 


AIT 
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69.} October 1, 
70.} October 2, 
71.) October 3, 
uses the true name 
72.) October 2, 
73.) October 3, 
74.) October 3, 
75.) October 3, 
76.) October 4, 
77.) October 5, 
78.) October 5, 
79.) October 5, 
80.} October 5, 
81.) October 7, 
82.) October 7, 
83.) October 10, 
84.) October 11, 
85.) October 10, 
86.) October 9, 
87.} October 11, 
88.} October 11, 


& 


1983, 
1983, 


1983, 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 


1983, 


10:29 PM. 
3304 PM. 


12:33 AM. 


3:11 PM. 
1:20 PM. 
4:47 PM. 
7:28 PM. 
2:21 PM. 
12:27 PM. 
4352 PM. 
12:32 PM. 
5:06 PM. 
1:04 AM. 


8:40 AM. 


1:30 PM.. 


2:14 PM. 
1:54 PM. 
1355 PM. 
2:02 PM. 


1:58 PM. 


NS 


This message 


b6 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 


The followi 
a_search of 


b6 
ellowing evidence is that bye 

{1) A green note paper with handwritten 
instructions on how to change passwords on 
a Telemail account. 

(2) A shee bearing the Telenet dial-up bé 
number and a Telenet 800 number, pyc 
800424-3494, 

(3) A New York telephone bill for number 

dated September 13, 1983, 
This bill contains numerous phone calls to b6 
area _code i i ome phone pic 
of aka, 


(4) This is a computer printout of all the 
administrators of Telemail customers. 


(5) This is a computer printout of numerous na) b6 
and addresses beginning withl b7C 
{6} This is a multi-page computer printout. 
On the back of the computer printout is 


found numerous handwritten user names 
associated with the illegal use of Telemail. 


{7) This is a Panasonic video cassette on which 


attended this picnic. On this tape beginning bé6 
at approximately counter numb ideo b7C 
tape camera is pointed toward and 

the 


erson taking the picture says, “There's 
Lh say ves." At that point, | —] 
replied, "Yes," and the camera pans away from him. 


Al tynwrud, va. 
snvestigation on 2/23/83 afrthiea;-tew York rite »_ Alexandria 
196A-633 Sub J 


oe 50 owe deta 12/23/83 be 
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my_name, it' 


2 


You can then he sa "You misspelled 
3 


then says, 


is wanted by the FBI. No kidding!" 
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NG, INCIDENT REPORT ** err 
nazarelh 


GEPARTMENT OF SECURITY AND SAFETY + 
: PAGE OF 
IN ATURE OF INCIDENT. TYPE OF PROPERTY TAKEN 
Telerhone Fraud Investisation n/a H 
IDATE/TIMe OCCURED JOATE / TIME REPORTED EXACT LOC ATION OF INCIDENT ~ i 
9-7-83(See Relow)| 10-6-83 1100hrs Emyth Hall, Rm#322, Math Labs. ; 
AtAE OF COMPLAINANT OR VICTIM WITNESS (ES) NAME j 
Nazareth College of Rochester { 
FADORESS / STREET No. PROGRESS 7 STREET No. PHONE + 
4245 East Avenue | 
City STATE aur CUTY STATE 2p ' 
Rochester N.Y. 14610 i 
IOME PHONE BUSINESS PRONE ExT. Now IWAME OF PERSON ARRESTED ON SUSPECT 
i 
iP 536-2525 [7 bé 
SEX DATE OF MONTH DAY YEAR ADORESS / STREET No. PHONE b7C 
BIRTH { 
n/a n/a { 
PENAL LAW SECTION OR COLLEGE CODE cit: STATE ZiP 4 
L ™ 
NARRATIVE JDESCRIFTIGN: 
{ty Summarize details of incidant [2) Describe onysical evidence or | 
property found and disposition (3) Describe injusies, give Ooctor’s 
name, Hospital nama, etc, (4) Oescription of sussects (5) Names of SEX ‘a OF MONTH DAY YESA ' 
additional witnasses: BIRTH cat 
i 


veported that[ 
of ad returne Is monthly telephone BT for Sep- 


tember, with Questionable calis to six long distance locations, in and 
out of the country, not authorized by he’ or anyone in his department. 
The telephone number that the calls originated from are computer phones 
in the Math Lab. One private number is and the other pss 
The calls were made from the latter number. They are as follows 


n bé 
bic 
#2 - 
#3 - 
#4 - 
#5 - 
#6 


fritish Columbia 
British Columbia 


Renner Texas 


(See attached telephone bill) 


The telephone calls were all made on Wednesday, September 7, 1983 
between the hours of 2:44PM and 4:27PM while the math labs were open 
for use by students. 
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azareth DEPARTMENT OF SECURITY AND SAFETY 


Copies NOT 10 BE MADE WITHOUT APPROVAL OF THE DIRECTOR OF SECURITY 


PAGE oF 
(NATURE OF INCIDENT 
Telephone Fraud Investigation NARRATIVE 
IOATE /STIME OCCURED IDATE / TIME REPORTED {1} Summariza details of incident {2) Describe physical evidence or 


Property found and disposition (3) Oescribe injuries, give Ooctor’s 
10-6-83 L1LOO hrs{ — name, Hosoitar name, etc. (4) Dascription of suspects (5) Names of 
Bdditianal witnesses 


9-7-83 


was listed to 


i 
the residence of BIC 
isted as being employed 


subject was 


wenn n-ne ee oe ee INVESTIGATION TO CONTINUE -----~-------------------- 


10:20:83 / Television station WOKR first broke the news that | 
of rs |) ee been questioned by agents 
In Tthaca and ccmputer equipment taken and confiscated from his room. 
This, according to the media coverage occurred on October 12, 1983 at 


CC — ——— The students involved in this 
raid were thoueht to be a part of a nationwide ring who allegedly got 


into the Telemail computers_in Alexandria, Va. (See Attached articles) bé 
I contacted Special Agent of the Roche fice of the FBI pb7c 
lon of and also 


at Cornell, who referred me 
5) z ice of the FBI. Agent 

(1-607-272-6424) as a nice kid, very coopera- 
tive, understand ted that he had also spoken via telephone 

to the parents in who were wonderful people. He stated the 
youth was not charged but the equipment was confiscated and that charges 
may be pressed in the future. 

Agent 


suggested I talk to the parents and| 
and felt that would be cooperative shou is att ey b6 
allow him to talk to me. of our_computer center in BIC 
ae with[> [were both 


Smyth Hall basement and 
notified of the investigation. oo 


On this date, I telephoned residence and spoke to 
[sand later to oth were cordial, though 
Suspicious at First due to the calls from the media. They described 


their only son as a straight honest boy who didn’ he was committing 


tnaca 


rere over the _surmer to meet 


» according to 
h 


ey agreed to have me ta to him later this month after the publicity 


ee | 
orm ERE || foo Bre 


vA co Q@rrcementar INCIDENT neg pee 
y. areth — 


GFE DEPARTMENT OF SECURITY AND SAFETY 


% PAGE OF 


? @RTURE OF INCIDENT 


I Telephone Fraud Investigation NARRATIVE 


ATE TIME OCCURED DATE / THE REPORTEO Uy Summarize details of incident (2) Describe onvsical avidence er 
Srope.ty tound and disoosition {3} Describe injures, giva Ooctor’s 


9-7-83 10-6-83 1100 hrs} name, Hospital oume, etc, (4) Oascription of suspects (5) Names of 
additional witeasses 
subsides. Both_stated chat he has cooperated fully with the FBI and ac- 
cording to Agt.L st ‘felt that he would cooperate with us. b6 
i b7C 
aaa leatherette Investigation to Continue -------- SS Seossre Sener 


The incomplete roster of those using the room on the date in 
question, showed the names of only four persons that afternoon, and 


they are: 
rasiding in home _ address: 

- home phone: ne 
or Residing in home address - bas 
ae tome phone 

i =z 

ira) 

BS 

pad Ist- 
5° ings o b6 
5 § , BIC 
2 3) eae the Admissions office is also taking a course but 

iz & was not abie to use the computer room that day, nor during business 

—q ® hours. : ; 

fou 

=, * -: = 

wie) Ssastrsesessecss soles Investigation to Continue ------+-------------n-e 
26 

zg Copies to: 

a3 b6 
5 eE bic 
ae 

b 
3S 7 2 

> = Special Agent - Rochester FBI Office 

ie E “Special Agent - Ithaca FBI Office bE 
pany with extra copy. for Special Agent bic 
2g < originating case agent in Alexandria irginia 

Bis Ong cr eRae ee os pee cer rece epee eos r ress eee eo tone (ee pee seat 
22° 
wat o 

> 
22 S 
ao = 
£3 
wa & 
an 3 

< 

pas 


bd 


zarel 
% 
oe 


na 


23t b6 
STATUS. eo Ye rs 
a aba! ed ae 
2 = Was 


Ogee WMD OWN ACN AUERESIEN, A 1 reine - 


“ey PHONES: CALL 955=~ 70 “BILL Lt t= 
PLEASE PAY BY 
PAST DUE AMOUNT TOWAL NEW CHARGES PAY THIS AMOUNT (SEE BACK OF BILL — oe 
200 | 53.00 I :* 53.00 I OCT 14 198% 


pent. Tle pect. & 


NAZARETH COLLEGE 
4245 EAST AVE 
ROCHESTER NY 14618 


APPROVAL FOR PAYMENT 


ba 
Dept. Head “4 Date Ff 37 


Comptroller Date $ 
Treasurer Date 
Paid 
Check #¢ 
BALANCE FROM PREVIOUS BILL 08=-19=8 Date "eG 


MONTHLY SERVICE 09*19 THROUGH 10=18 


62 METERED CALLS . 5-02 
GROSS REVENUE SURCHARGE Le2k 
. 
LONG DISTANCE CaLus ‘ 
~#_D. LACE 4 Nth iE MIN 2 CHARGE 
1 0907 244P 90 4.16 
2 0907 301P- 23 0 14643 6 
3 O907 PRINCEGRGEBC €04=562=9515 410P 10 289 bic 
4& 0907 PRINCEGRGEB 604856229515 411P 10 089 
5 0907 412P 3 0 1614 
6@ 0907 RENNER TX 214=931=3437 427P 1 0-__ 264 
TOTAL LONG DISTANCE CHARGES 22015 22.15 
TOTAL TAXES FED «00 ST/LOCAL .00 paele) 
PLEASE PAY THIS AMOUNT BY 10-14. 5320C 


SEE REVERSE FOR INFORMATION ASOUT LONG DISTANCE CALLS, 
PAYMENTS AND LATE PAYMENT CHARGES: 


Yow 


nazareth 


#_ Date Place Called Number Called & Party Time Min. Charge 
1 97/83 Cid 2:44P 9 $4.16 6 
(Non-Pub) bic 
2. 9/783 [__ 23 $14.43 4 
. z x for prc 
3. 9/7/83 Prince George, 604-562-9515 4:10P 1 $ .89 
British Columbia Auxifliary Line for (562-9513) 
__ Native Court Records _ 
4. 9-7-83 Prince George, ’ 
British Columbia Same as above 4:11P 1 $ .89 
b7C 
&. 9-7-83 Renner, Texas 214-931-3437 4:27P 1 $ .64 


(Auxilliary Number 
931-3252) 


Helco Commodity Research 
Division of Clayton 
Brokerage Company of 

St. Louis 


All. calls placed on Wednesday, September 7, 


TOTAL $22.15 
1983 between 2:44PM and 4:Z7PN” 


from 586-4773 to the above numbers and listings. 


cae 


NAZARETH COLLEGE OF ROCHESTER « 4245 EAST AVENUE + woo BO YORK 14610 + 716 586-2525 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/9/84 


Date of transcription 


The following is a summary of messag: 


on the GTE Telemail System by the illegal user bé 
The format of this summary will be as follows: e time bic 
and date of each message will be stated, with a synopsis 
of the message if it igs deemed particularly significant 
or contains incriminating statements. 
1.) September 3, 1983, 1:34 PM (all times Eastern 
Daylight Time). 
2.) September 5, 1983, 11:35 PM. Mess. reads: bé 
Harry, what do you think happened toL__P signed{. ft 7c 
3.) September 9, 1983, 9:37 AM. 
4.) September 10, 1983, 12:31 PM. 
5.) September 10, 1983, 12:33 PM. 
6.) September 10, 1983, 7:08 PM. 
7.) September 10, 1983, 9:23 PM. 
8.) September 11, 1983, 1:19 AM. This message 
reads_j t: "Also if you want to test out 2600 Hz, be 
cal] There's a ‘number changed' recordin bye 
that you can cer-chunk off of if you want. Signeql 
9.) September 26, 1983, 8:24 PM. 
lovestigation on 12/8/83 Alexandria, Virginia Alexandria 196A-633 
bé 
. sala 12/8/83 bre 


Date dictated 
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FEDERAL BUREAU OF INVESTIGATION 


i 


ate of transcription 


a a computer programmer, examined 

the flo’ iscs that were seized in the sear bé 

and at bic 
that a iscs 


were examined and no information relating to GTE Telemail 
or other telecommunication services were found. 


1/20/84 


s 
1/17/84 Alexandria, Va. : Alexandria 196A-633 
investigation on at File # 
. bé 
sat 9a 1/17/84 ac 
by Date dictated 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBi and is loaned te you: agency; 


it and its contents are not to be distributed outside your agency. 
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FEOERAL BUREAU OF INVESTIGATION 


sf yiiner sty 


Oate ot transcription _1/ 31/84 


Oa January 24, 19a4,[ 6 
ee GTE-Telemail, provided a copy of the amount of money pic 
os 7 


This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 
——| AHSC $62.29 July, August, 
September 
UAW 7 $31.00 September bé 
bIC 
| Maraven $16.00 August, Sept 
Telenet $108.00 July, August 
| BMW $0,239 September 
$127.58 


aes | CBOT $2.00 September bé 
bIC 
— RADA $1.00 September 


$3.00 
LCL] Maraven $24.00 August 
Telenet $325.00 July b6 
b7¢ 
Telenet $151.00 August 
a 
Necnripnilenten 1/25/84 a _Alexandria, Virginia rie a Alexandria 196A-633 


b7C 


This document contains nsither recommendations nor conclusions of the FBI. It 1s the property of the FBI and is loaned to your agency: 
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FEDERAL BUREAU OF INVESTIGATION 


12/15/83 


ate of transcription 


The following report is a summary of the activity 
oon the GTE Telemail System. This b6 
same information also applies to the activities off sd b7C 


wife, 


used the following user names 
The names 

and user names _in the node be 
called 


if and were bic 
illegal user names in the illegal node CBOT. 
under these various user names left messages on the Telemal 


System from approximately August 30, 1983 - October 1l, 
1983. 


on Telemai 


illegal node called 


felemail System, using one of the above-mentioned user bic 


names, at least 91 times from August 30 - October 11, 1983. 


used the names and bé 
C_s" ile a user in the illegal node RADA. She BIC 
used the names and while a user in the 

CBOT. 


is known to have access to Telemail bé 
System, using one of the above-mentioned user names, at BIC 
least 133 times from August 30 - October 11, 1983. 


A review of the actual messages themselves shows 


that the names[_——_—ijand loccur with some frequency b6 
in messages left on the Telemail System ne b7c 
or one of the other user names identifiable with 
and 
On September _12, 1983, at 12:32 eu[ ___] 
leaves a message for[ fon the Telemail System. 
This message states that Rochester Fire and Safety called b6 


and said that _the oxygen was ready and the ba" :nce due b7Cc 
was sise.[ Rochester Fire and Safety, 
was interviewe y agents of the FBI and he indicated that 


his records showed that on September 12, 1983, the home 


11/21/83 Alexandria 196A-633 


Fite # 


Alexandria, Va. 


Investigation on 


+ be 
wy SAD 89 cate sctates 11/21/83 bre 


at 


This document contains neither recommendations nor conclusions of the FGI, It 4s the property of the FBI and is loaned to your agency; 
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[po 


number for contacted to notify them 


that_a_ respirator for mother was be picked bE 
up. [feats that the telephone number was b7c 
i 


on the . 


bé 
b7c 
b7E 
On October 12, 1983, at the time of the search 
of his residence,[___]furnished a signed statement admitting 
to accessing a “computer program" by calling the local 
Telenet dial-up number, typi the word “mail” and then a 


entering a cod however, declined to discuss 
the user names 


or how he got access 
to the Telemail System. 


An FPD-302 reflecting _interview 
of [ ___Jaated October 12, 1983, indicates says 
he got the password for the Telemail account from 


AUG 


s+ ~~ e@ 


FEDERAL BUREAU OF INVESTIGATION 


10/19/83 


Date of transcription. 


was interviewed at his b6 
residence BTC 
He freely and voluntarily fFurnishe e Owlng 


sgned statement: 


b6 
b7C 
"Ty freély and voluntarily 
furnish information to § 
and 
"I was born[__ and have finished college b6 
in New England. bic 
"I have a personal computer that I use 
personally and professionally in my business. I have 
had a personal computer for about a year. 
is the number I use to access GTE b6 
Tele-net 716-454-1020 which I do often. I then access bic 
compuservice, dow jones, etc. Radio Shack, computer 
Stores, will tell you how to use GTE Teletnet. In 
addition I had accessability to a computer program that 
handled home messages by using tele-net 716-454-1020. 
Furthermore, this program was not created by myself 
or my wife. A message indicating "Mail" would alow 
entrance and code word would be entered. 
*We (my wife and I) would leave messages for 
each toher on the GTE Tele-Net both being at home, it 
was fun. On the advice_of my attorn t this time 
do not wish to discuss[~ Jana jor how I~ 
got access to these accounts. . be 
b7e 


"I had no idea what I did was a crime and will, 
with my attorney, discuss this with the government in the future. 


date ctober Pap 5) avian 


svestigation on 2O/22/83 DCS 


SA SAA and 
by.. SA YEE Ka Oate dictated 20/13/83 
i’ 
Ths dacumer? comains neitner recommendations nar conciisicns at the "BI, it is the property of tnt £9) and is loaned to your agency: 
it andl Ls cuntents are not to Ge distributed outsiga your zqeney. 


. “au 


b6 
b7Cc 


BU 196A-529 -2- 


Witnesses: 


q SA, FBI, 10/12/83, Rochester, NY 
ecial Agent, FBI, 10/12/83, Rochester, NY 
SAA, FBI, 10/12/83, Rochester, NY 


q 


In addition to the signed statement, he 
furnished the following information: 


He is employed at 


He did not know it was a crime to access GTE 
Tele-Net. The telephone number in Rochester for Tele-Net 
is 454-1020. He calls this number from his computer 
system number which is a line in his telephone. He then 
accesses the computer by using the nane[ 
(phonetic) and thereafter uses a password that he gets 
£rom a friend named who got it from an 
individual that was hesitant to discuss. 
did mention (phonetic) 


A4T 


b6 
BIC 


b6 
b7Cc 


b6 
BIC 


BU 196A-529 


\ 


During the conversation wien ars 
often telephonically contacted his attorney, 
Coo and[___Jassociate . 


indicated that he would be glad to 
cooperate in the future with any investigation and that 
all he wanted was his computer back since he did not 
know he was committing any crime. 


He stated that telephone|——=id in 


is a telephone number for an individual 
This is some type of college campus and 
infor ion is available from something called a freak 


board and through this number information can be given 
on how to build “black boxes" to access all kinds of 
sophisticated computer systems. 


I 


gave this as an example of the type of 


information he has available and is willing to provide 
the government, through his attorney. 


AY¥9 


b7C 


b6é 
b7c 


b7c 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription. 2/2/84 


The following is a summary of the activity of b6 
jon GTE telemail. b7c 
used the name 
and b6 
were illegal nicknames in the company pre 
called RADA. was his user name in the company, 
CBOT, and was his user name in MMM Company. 
[was also 
is known to have accessed the telemail b6 
system, using one of the above-mentioned aliases, approximately b7c 
170 times, from approximately August 30, 1983, through 
October 10, 1983. 
was initially a member of the group be 
known as Short for 1 which was bre 
run_b aka, fe Tater became 
a group known as LINCOM in CBOT. 
b6 
BIC 
b7E 
e@ matched be 
using one of his aliases, bic 
actually entering the telemail computer. 

On October 12, 1983, at the time of the search be 
of his room,[___—sdlstated that he guessed the search bre 
was due to his telemail computer contacts he made from 
his room. 

Investigation on 1/30/84 _at_Alexandria, Virgini rie Alexandria  _ 
196A-633 
b6 


oy safe pases 1/20/84 Bre 


This document contains neither recommendations nor conclusions of the FGI. ft is the property of the FB! and is loaned to your agency; 


it and its contents are not to pe distributed outside your agency. 
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A review of the paper evidence seized during 
the search revealed among other things, hand written instructions 
on how to change passwords on a telemail account, and “user 
names" identical to those used to illegally access telemail. 


on october 12, 1983, ]} another 


subject in this matter, said he qot the password for his be 
telemail account from[ bic 
a 


25) 
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Date of transcription. 


October 21, 1983 


was advise the identity of the interviewing agent 
as Special Agen SA Federal Bureau of Investigation, 
Ithaca, New York. was shown a copy of the search warrant for 
which he read and stated he had no auestions: | was 


asked if he had any idea what the basis of the search warrant was and 
he stated that he guessed that it would be + (Rana | Telenet and Tele- 


mail Computer contacts that he had #madé- fron fre eh was 3 b6 
asked how he had heard of these computer services and he stated he bIe 
learned of them from by the na 
who is also known to him as who resides in 
LJ statea that he first became_familiar with by way of com- 
ter approximately one year ago. further advised that 
is described as follows: 

Height: 

Weight: 

Race: 

Complexion: 

Date-of-birth: 

Education: b6 

b7c 


Home address: 
Home telephone number: 
College number: 


10/12/83 


b6 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be gistriputed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


i Date of transeription__2/2/84 


ollowing is a summary of the activity of 
on GTE telemail: b6 
. b7c 
used name in a company 
called RADA an in a company called Csor. 


accessed the telemail system using one 
of these two names, approximately 19 times, from approximately 


b6 

September 3, 1983, to September 29, 1983. pyc 
initially was a member of[____ Rapa, then 

was a member o CBOT, 

A_review of trap and trace records i at 

b6 

b7e 

with telemail bIE 


laccessing the telemail system. 


October 12, 1983, during the search of bé 
told FBI agents that bre 
had been using telemail to communicate with friends 

in Rochester, New York. 


1/30/84 Alexandria, Virginia 


tavestigation on at 


Alexandria 
196A-633 
bé 


bic 
sa mibe bate ance 1/30/84 


File » 


‘This document contains neither recommendations nor conclusions of the FI, It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription OC tober 21, 1983 


, was_advised of the identity of = interviewing agent 


as Special Agent (SA) Federal Bureau of Investigation, 
Ithaca, New Yor OAM. was furnished a copy of the search 
warrant for which he read and stated that he understood and 
nad no questions. was advised that he could observe the search 
if he cared to but because of the small size of the room was advised 
to stay in the doorway so as to not interfere with the search. bée 
stated he understood, was going to make a telephone call, and then bic 
except that invitation to remain in the doorway to observe the search. 
stated he did not know the basis for the search. He did advise 
that had been using a computer service 
called Telemail to communicate with friends in Rochester, New York. 
Lis described as follows: 
Height: 
Weight: 
Race: 
Complexion: 
Date-of-birth: 6 
Education: prc 
Home address: 
Home telephone number: 
College number: 
tavesgation op LOL 42/83 oT rg E2677 
b6 
7c 


wy sa ea 


- Date dictated 


10/14/33 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
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it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


PROSECUTIVE REPORT OF INVESTIGATION CONCERNING 


also known as b6 


FRAUD BY WIRE; CONSPIRACY pie 


Copy to: 1 - USA, Alexandria, Va. b6 
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NAME OF DEFENDANT: 


———s described as: 


Race fA 

Sex 2 

Date of Birth CW 

Height bé 
Weight bic 


Social Security 
Account. Number 
Address 


AX 196A-633 


PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


2. On October 12, 1983, the premises located at 

was 

searched pursuant to a duly authorized federal search 
warrant and various computer paraphenalia were seized. 


b6 
b7C 


a 40 


ae 
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WITNESSES: 


1. 


2. 


3. 


ne —_ 


8229 Boone Boulevard be 
Vienna, Virginia bIC 
Telephone [1] 

Can provide details of GTE Telemail operations, 

methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


a x 
peciai Agent IC 


Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent 


Federal Bureau of Investigation Pe 
Oklahoma City 
bé 
. - bIC 
Can provide testimony thac[ ene 
are the same, as we as 
information about use of the Telemail 


System. 


Pull text of interview pages 3 - 6, attached. 


Abel 


AX 196A-633 


5. 
b6 
b7c 
Can identify as and provide 
information about use of the Telemail. 
Full text of interview page 7, attached. 
6. 
be 
b7c 


Can identify as and provide 
information about use of Telemail. 


Full text of interview pages 8 - 10, attached. 


ood 
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EVIDENCE: 
i. Summary of 65 messages left on Telemail b bé 
originals in possession of b7c 
GTE Telemail). 


2. Report with attached inventory of items seized 
in search. 


3. Two reports summarizing relevant items found 
in search (originals in possession of FBI Alexandria). 


4. List of charges attributable to aka 
(original in possession of . 6 
5. A Panasonic Video Cassette on which identifies pie 
himself, then says "You misspelled my name, it's 
is wanted by the FBI. No kidding!" (original 


in possession of FBI Alexandria). 


6. Summary of trap and trace information received 


63 


——puriog (REV. 3-8-7) 
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FEDERAL BUREAU OF INVESTIGATION 


1 
Date of transcription. 12/15/83 
The following is £ fel ft by the b6 
illecal user using the name anc b7c 
on GTE Telemail. 
The date and time of each message is provided with a 
synopsis of particularly sianificant messages incluicd, 
1) August 28, 1983, 9:36 p.m. {All tires are Lastern 
Davliqht Time) This message reads as follows: 
»-I have found a few administrator accounts. be 
Please fill me in on how to do the ecue with bre 
the reg user, etc. etc. commands...and any advice, 
any advice you may have for going as uncetected 
ae possinle. Thanka,[ > 
2) Aucust 26, 1953, 11:31 Den. 
3) Amqust 29, 1933, 11:06 o.m 
“Hello welcome to 
bulletin board b6 
with other network users. Current : bie 
I 
the Administrator 
message to Admin 
4) August 29, 1933, 1 p.m. This message reacs in 
part, “Please refrain from the f real names Pe 
or obvious tip-offs while using private 
mail, or any other communications on Telemail. 
Please use general information only. Use_obvious 
information at your own risk. Thank youll} 
Administrator." 
5) August 29, 1933, 
G) August 29, 1983, 
7) August 30, 1983, 
8) August 30, 1983, 
9) August 30, 1983, 
10) August 30, 1983, 
11) August 30, 1983, 
12) August 30, 1983, 
13) August 30, 1983, 
tnvestigation on 2/9/83 alexandria, Virginia cue _Alexandria 196A-633 
n6 
vy_SA btl bate aictarea__ 12/9/83 bic 
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it and its contents are not to be distributed outside your agency. 
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contnason othieniowar [or Page 2 


14) 
15) 
16) 
17) 
18) 
19) 
20) 
21) 
22) 
23) 
24} 
25) 
26} 
27) 


28) 
29) 


30} 
31} 


32) 
33) 
34) 
35) 
36} 
37) 
38) 


bE 


August 30, 1983, 5:54 p.m. 

August 30, 1983, 10:57 p.m. 

August 31, 1983, 5:33 a.m. 

August 31, 1983, 5:35 a.m. 

August 31, 1983, 11:14 a.m. 

August 31, 1983, 1:47 a.m. 

August 31, 1983, 5:04 a.m. 

August 31, 1983, 5:14 a.m. 

August 31, 1983, 5:37 a.m. 

August 31, 1983, 5:40 a.m. 

August 31, 1983, 6:08 a.m. 

August 31, 1983, 6:26 a.m. 

August 31, 1983, 6:26 a.m. 

September 1, 1983, 8:31 a.m. This message reads in 
part, "Oh, by the way, a reporter for a newspaper 
is coming here today to interview me on computer 
theft. I'm afraid I'm going to have to disappoint 
him when I tell him that I really know nothing about 
it. (Ha!) Later, " 

September 1, 1983, 7:25 a.m. 

September 1, 1983, 1:01 p.m. This message reads in 
part, “I'm real sorry about screwing you up with 
those accounts under RADA. It's just that according 
to Telemail will make drastic changes 
to the entire system if they realize an infiltration 
of any size of unauth. users...especially after the 
god damn media blitz about the 414's.” 


_ September 1, 1983, 1:50 p.m. 


September 1, 1983, 12:56 p.m. In this messaae, 
states that he has obtained the dial up access 
number for Long Distance Savers, Inc. and has hacked 
out a customers code. He also indicates that he has 
used this code to make illegal long distance phone 
calls. 


September 1, 1983, 1:25 p.m. 


September 1, 1983, 1:27 p.m. 
September 1, 1983, 6:08 p.m. 
September 1, 1983, 6:12 p.m. 
September 1, 1983, 1:28 p.m. 
September 2, 1983, 9:26 a.m. 


bIC 


bE 
BIC 


September 1, 1983, 9:03 p.m. This message is to b6 
a reads as follows, |] thanks ®7¢ 
for the info. Will try it out next time I get on 


a DEC-10. 1'11 dump those hacking programs to you 
here in Telemail if you have a terminal program 


L265 


ae 
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contnatontinerwst_ [doe fT 


Page 


3 


capable of data capturing and saving to disc. 

Then you just unload it in and save it back out 

again, this time it will be saved in the non-ASCII 

compressed format which loads faster. 
39) September 3, 1983, 8:13 p.m. ‘This message reads as 

follows, "Dial, the following Sprint Code is a 


Later 


bIC 


business Sprint account. As such it will go anywhere 


in the United States, inclucing Alaska and Hawaii. 
It also may go to Canada, althcugh I haven't tested 
it. The Code is 54830522. Use this code only for 
calls that you can't make with ordinary Sprint. 
also suggest that you first dial a city such as 
Saint Louis or Chicago, then use this Sprint Code 
Please don't use 
Oklahoma City. Please consult the Sprint Directory 
I sent you to rancomly select a large city to route 


from there to place your call. 


through. Thanks[_ |” 


40) September 4, 1983, 
41) September 4, 1983, 
42) September 6, 1963, 
42) September 7, 1963, 
43) Sertember 8, 19%3, 
ga) 

44) 

45) 

46) Sertember 6, 1983, 
47) September 9, 1963, 
48} Sertember 10, 1983, 
49} Sertember 12, 1963, 
50) September 12, 1963, 
51} September 12, 19723, 
we Sertember 12, 1903, 
S30. Scepter Ye D354. LIS, 
54} 


September 13, 1963 5 
L Jo alil___|Merhors. 


is "Be careful." The messace is 


“The following forwardec notices 


S messace is 
sulject of the message 
fellows: 

sample of the 
ways that one carn easily be cetected if hackina 


Telemail...and he does not know what he's 


Se rlease take heed of the fact 


illustrated 


bé 
bic 


be 
b7C 


letter that it is important that you don't do anything 


strange like changing your nare and your directory 


file to read something like Adam and the Ants or some- 
thing like that which would be rather obvicus. 


please unless you know what you are doing don't 
phuck around with Telemail, other than the use of 


, Lobe 
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contruston of mtemmewat__[ orf Page 4 
heck and send mail _to pre 
users of Thank you, 


Admin." 


This is followed by a forwarded 
érom [ake con 
how Telemail bills their customers. 


55) 
56) 
57) 
58) 
59) 
60) 
61} 
62) 
63) 
64} 
65) 


your account to 


and the 


message 

cerning 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 


13, 1983, 
13, 1983, 
13, 1983, 
13, 1983, 
13, 1983, 
13, 1983, 
13, 1983, 
14, 1983, 
14, 1983, 
14, 1983, 
20, 1983, 


b6 


12:09 p.m. 
1:04 pom. 
12:49 a.m. 
2:57.a.m. 
2:40 pom. 
3:59 p.m. 
8:14 pom. 
9:51 a.m. 
1:39 pom. 
5:53 pom. 
6:15 pom 


b7C 
a 
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FEDERAL BUREAU OF INVESTIGATION 


Ll Date of transcription Decomher 7, 1983 


The authority of a search warrant issued in the Western 


District of Oklahoma by United States Magistrate Ronald L. Howland, 
a search of a residence known as b6 
was conducted. Attached is a copy of the receipt and inventory pyc 


of the items seized pursuant to the se py of the 
receipt and inventory was furnished a who was 
present during part of the search and was present at the conclusi 
of the search, This inventory was made in the presence off 


and his son, 


14%, - Sd 


“oklahoma City 


invesugasion on__LO/1 2/83 file ¢ L96A-1270 
—__b6 
b7C 
by Daw dictatea 10/12/83 
This document contains neither recommendations nor conclusions of the FBI. It 13 the property of the FBI and is loaned to your agency: 
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FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


Gate of transcription 12/7/83 


The following is a review of evidence seized pursuant 


premises known as 


to a duly authorized Federal = — executed at {"° 


This is the residence o 


The following is a summary of evidence relevant to 


this investigation: 


1) A white 3 x 5S card with numerous user names and 
passwords. The computer system is unknown. 


2) An 8 x 10 printed pamphlet with the title, "Free 


Long Distance” with numerous references to MCI 
codes and Sprint codes. 


5) Envelope with numerous addresses on mailing labels, 


6) A printout on silver paper with numerous listings 
including, "Introduction to Telenet," Blue Box 
Operation, and containing numerous Sprint access 


numbers. 


7) Paper with instructions on computer systems known 
as, "DEC 10, and DEC 20, containing instructions 
about access in the system and passwords. 


8) A long printout containing numerous first names, 
followed by, "Interests." 


9) A printout that refers to a prime computer. 


be 
bIC 


be 
b7c 


be 
bIC 


be 
b7c 


investigation on__11/10/83 sat Alexandria, Virginia rie «Alexandria 1l96A-633 


This document contains neither recommendations nor conciusions of the FBI. It is the property of the FB) and is loaned to your agency: 


bé 


it and its contents are not to be distributed outside your agency. 
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10) A scrap of paper with numerous names and phone 
numbers, not identical to any known subjects. 


11) A printout of "Bulletin Boards in North America" 
including, Telenet numbers and Telenet System 
Commands. 


12) reen envelope addressed to 


A 


be 
b7c 


This envelope contains a handwritten note, 
called. He says its better to send 
the tapes by USPS rather than UPS." 


13) Two copies of a "Revised Telenet Phone Number 
Guide." 


14) A two page photo copy of “Revised Tymnet Phone 
Numbers." 


15) Pour copies of "Uninet Network Access Phone Numbers." 


16) Two copies of a letter a from 
the office of Legal Counsel, University of Oklahoma, 


dated September 30, 1982. This letter is in reference pb6 
to the termination of the lease at bIC 
The letter mentions in part, "You_have willingly 

and knowingly allowed your son,[__—si4S to operate 

a computer business from this premise." 


17) A printout entitled, "All About User-Publishing." 


18) Two copie of a printout entitled, ; | b6 


Mailing List.” pyc 
19) One copy of "Sprint Access Numbers." 
20) A printout with various names and user identification 


numbers, none of which are identical to known 
subjects in this matter. 


21) A typewritten xr titled, "Macrohost Commands- 
is J" 
bé 


b7c 
22) Mailing envelope addressed to a containing 
a floppy disk labeled, "All ST80 Modules, plus 
Non Com/ctl." 
23) Printout titled, "Connected to the Source” with bé 
a message on that printout from b7C 


FoI 
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24) A computer printout with a message froml_—sdzi 
on it. 


25) A printout indicating_a connection to the source, 
with a message from ; nt 


26) A printout again showing a connection to the source. 


27) A forty-seven page copy of a pamphlet, indicating 
various ways to cheat the phone company. 


28) A typewritten paper called, "Scanning for Co 
on the Northern Telecom Switching System” by 
This paper describes how to obtain 
Sprint codes. 


29) A typewritten brochure on, *Picking Ward Locks." 


30) A typewritten brochure on, "Picking Other Types 
of Locks.” 


31) A typewritten brochure on, "Phone Operations.” 
32) A printout that is a letter from 


soliciting a computer bulletin board ad. On this 
printout, he gives his home phone number and address. 


33) A printout with a message fron, | 
containing codes for extending numbers. 

34) An 8 x 10 sheet of paper with various 800 numbers 
written on it. 


35) A printout with source accounts and passwords. 


This printout also contains a message from 
a In this message, referrs 
to his “real identity" and to the fact that he 
believes “law enforcement” is watching him. 


36) A handwritten questionaire about bulletin boards, 
including the question, “Would you participate 
in a secure, private, freak bulletin board on 
the source?” 


37) A piece of cardboard containing a mailing label 
indicating the object was mailed fron[- 
to was a subject 
of a search in in this matter. 

ofa 


LFZ3 


bE 
bIC 


b6 
b7c 


b6 
BIC 


b6 
b7c 


b6 
b7Cc 


bé 
b7¢c 
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38) 


39) 


40) 


41) 


42) 


43) 


44) 


45) 


46) 


A Sprint bill addressed cs | and 
dated December, 1982, in the amount of $572.00. 


A printout with numerous names and identification 
numbers on them, none identical with subjects 
in this case. 


A typewritten paper mentioning "USEMC-BBS." 


A printout of a message from asking 
for information on how to hack a prime terminal. 


A "Temporary Users Guide to the United States 
Electronic Mail Center” dated August, 1983. 


A printout with a message from about 
accessing the computer at the University of Kentucky. 


A printout with a message from - 
and in reference 
to accessing a computer at Boystown. 


A printout froml_ sd referencing a Telemail 
Account. 


47) A paper with the name 


48) 
49) 


50) 


51) 
52) 


A printout with various MCI access codes listed. 


A handwritten letter from[___—itgk akaL_sd 


Newspaper article with picture 4 
Included in the text is the quote, as follows 

“Modem users are required by Pederal law to register 
their modems." 


Letter from[ sto the Office of Legal 
Counsel, University of Oklahoma, Norman, Oklahoma. 


Poip— 


AITY 


b6é 
b7c 


be 
bic 


be 
b7c 


be 
bic 


b6 
b7C 


be 
b7¢ 


be 
b7c 
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BIC 


AX 196A-633 


53) 


54) 


55) 


56) 


57) 


58) 


59) 


——~ 60) 


61) 


in reference to legal action against the phone 


company in reference to Modem charges. 

Printout of message on "“Compuserve” from 

Listing a return address of 

Printout of program to a bulletin board established 
i called "USEMC of Norman, Oklahoma." 


A printout of messages from the Osuny Bulletin 
Board. In this message,[- talks about. 
Chicago. 


A printout with messages about MCI access codes, 
source accounts, etc. 


Is a printout containing a message fron[___ 
Within the message is the statement, "A remailing 
service is now available exclusively for members. 
If you need to leave your address for illicit 
urposes, you may leave a Post Office Box in 

and your mail will be forwarded to you 
first class for the cost of postage, plus fifty 


percent." It continues "If you are interested 


A printout with a list of names, each name preceded 
with the words, User ID: and then the numbers 
i,l. These numbers continue down to user ID: 


1,93. The name. 
ane[ appear on that list. 


A computer printout beginning, "Dear Fellow Modem 
User, and continuing with the statement that if 

a person wants additional information on how to 
avoid paying the extra charge-for a modem, the 
can write to the address 
and the number is 
be a compuserve account. 


(which appears to 
ddress also 


one number Voice; 
300Boud. t Hu 


A copy of a page out of a book titled, “Revised 
Telenet Phone Numbers.” 


Bz. 
APS 


be 
b7¢c 


be 
b7Cc 


b6 
b7C 


b6 
b7C 


b6 
b7c 


b6é 
b7c 
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62) 


63) 


64) 


65) 


66) 


67) 


68) 


69) 


A printout containing a_ message from the Telemail 
Account | The text of 
this message says "I can only get the quick reference 
booklets at this point. They are about ten pages 
each. I can xerox important admin_functj also." 
The message continues "telephone b6 
Name: 53552, Password: 426," and then the message bic 
continues, “and ve address there. OK? Take 
it easy, Signea ye This sheet of paper 
also has handwritten no ini the name, 
and 
has the name, 
and the number 


Four pages of typewritten material, beginning 

with the words, "The Electronic Mail System." 

The fourth page of this document is titled, “Calling 
Through Sprint™ and suggests that if you have 

called the Osuny Bulletin Board, that “Your number 
is prebably being traced." This article also 

states that this bulletin board is_in fact 

which was the illegal account that had 
created on Telemail. 


be 
b7c 


A typewritten page with one paragraph entitled, 
"To Get A Pree Telset From Bell." This paragraph 
gives you details about how to obtain a person's 
actual number of extensions in his home and then 
call the local phone store pretending to be that 
person, and arranging to get an extension that 
the innocent person will be charged for. 


A printed sheet of paper titled, "Maxhost/Cmd be 
pL Be 
A computer printout beginning with _t words 

The USEMC V. 6.0, copyright 1983, b6 


bICc 


A copy of two pages labeled, “Local Telephone 
Numbers for Access to the Sprint Network.® 


A sheet of paper with numerous telephone numbers 
in Los Angeles, San Diego, Boston, St. Louis, 
North Carolina, Hawaii, and Texas, written on 
it. 


A computer printout with numerous messages referring 
to obtaining Sprint codes. 


ATE 
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70} 


71) 


72) 


74) 


75) 


76) 


77) 


A computer printout containing the message number 
8: titled, "fo Pind Telenet, Dial your local 
Access Number, then at the @ sign, type in MAIL. 


A_computer printout with the handwri be 
followed by the address, pyc 


A series of pages titled, "The United States Electronic 
Mail Center - Version 6.0 Users Manual, Summer 


of 1983." This typewritten page contains the be 
words, “The USEMC~DBS-300Boud Bre 
Lt Copyright 1983, by 


A computer printout containing the names of numerous 
administrators for Telemail Accounts. Handwritten 

above these names are the words, "Checked September 12-13, 
1983. 


A computer printout with numerous user names followed 
by the words, "User ID: and a_number, followed 


by a second number. The names and pyc 
a’ as well as appear in 

these names. 

A computer printout e@ Telemail System. 

The message is from | The message 
states to go undetected in the system, use a b6 
regular user name, such asl for other names BIC 


that are common. The message continues and lists 
commands that administrators of accounts can use. 


A computer printout with two messages. The first 
message says, “Here are the dial up to the NIH 
computers!“ It then lists the dial up numbers 

for three National Institutes of Health computers. 

A second message is from Jupiter FBN. The message 
says, “Here is an Arpanet access number, 800/638-4870. 
It is a TAC computer (Military Network}. Don't 

abuse it because I desperately need that Watts 

line for communication.” 


A computer printout listing a number of host systems 
on Telenet. Following the listing of about twenty 


companies, is the statement, "I thought I would be6 


post these because they might be interesting because bre 
they aze Located in canada: signedf 
circle. 


Followed by the words, "The inner 


dT 
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78) 


79) 


80) 


81) 


82) 


83) 


84) 


85) 


86) 


87) 


Two typewritten pages titled, "The Telephone Connection 
Premiere Issue, February, 1983." The article 
discusses among other things, Security 

on Compuserve, and Telephone Tracing, and Sprint. 


b6 
BIC 


A computer printout with the words, "Dial up - 
(202)695-0441, followed by the word, password 

- DARCOM. Followed by the words, “For an outside 
line, simply say, outside line, you must first 
specify "Routine Traffic." These are instructions 
for someone to illegally access the military's 
autovon system. 


Two pictures of a computer setup, taken in December 


of 1982. his appears to be the computer setup be 


A computer printout with numerous listings as 

follows: "MCI found at: and access code and 

the local MCI dial up.® Also f don this computer b6 
printout, is the i pea and pyc 
the word, 


A copy of a sheet of paper, titled “Uninet Network 
Access Phone Numbers by States." This sheet of bé6 
paper bears the initials,[ } b7c 


A_letter addressed tol Cid Eom 

Counsel for the source. The letter states, 
"As we discussed, enclosed is a STC subscriber 
agreement." The letter then continues, "I look 
forward to hearing from you on the source regarding 
the Oklahoma modem charge." 


A three page typewritten letter beginnin "Thank 
you for your jnterest in the psemc-ass{ 


and signed by bie 


b6 
b7c 


A typewritten pamphlet entitled, "The United States 
Electronic Mail Center, Revision 6.0, Temporary 
Users Guide, September, 1983.*% 


A computer printout containing what appear to 
be the names of the administrators of various 
Telenet/Telemail Account holders. 


A long computer printout referring to requests be 
by[ fee other bulletin board users to pic 
give him stolen Sprint account codes, because 

he is on his last one. 


AVE 
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88) 


89) 


90) 


91) 


92) 


93) 


94) 


95) 


95) 


96) 


sette with the w ne and the number 
On this tape, is talking 
to another person on the phone. They make up 
a fictitious name anf |makes a collect phone 
call to that name to see if the call can actually 
be made. The call is to a place called Death 
Valley Junction, and the phone number is 2. 


Aco} of a Sprint Travel Card bearing the name 
_ and numerous Sprint access 
codes and Metro phone access codes written on 
it. 

A white card bearing numerous Sprint codes and 
the "date found" and the initials of people that 


he gave the Sprint codes to. 


A white sheet of paper bearing numerous Sprint 
codes. 


A_ sheet of Paper bearing the words.[S=id@d 


Part of a Southwestern Bell phone bill, dated 
August 21, 1983, for phone number } 
It contains a bill for a call to ni er (3914 5~4060, 


which is the Osuny Bulletin Board. 


A subscriber form for long distance savers, with 
the salesperson's name listed as 
The subscriber's name is 


A_sheet of paper bearing the name 
[wo 


telephone numbers are next to the name, as follows: 
ee P| 


A typed sheet of paper, "Prepared 4 a 
which lists instructions for creating a red box, 
which appears to allow you to fake the sound of 
coins dropping into a coin phone. 


A computer printout with a list of the followin 


also has in_handwritten form, the name, and 
the number Next to this, is written 


Eke name [the nabs Ses EEE 


is also written on the paper. 


b6 
b7C 


bE 
bIC 


bé 


b6 
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97) 


98) 


99) 


100) 


101) 


102) 


103) 


104) 


105) 


106) 


10 


A computer printout with the names 


A computer printout of one hundred and ninety-three 
names, beginning with the namel and 
the password, Video. 


A_computer printout bearing the handwritten words, 
andl 

A white piece of heavy paper, bearing approximately 

twenty names dd passwords. The third name down 

ish with a password Arpanet. 

A telephone bill for telephone number [___] 

dated July 21, 1983. The following numbers are 

frequently called: 


A computer printout from[ 7 


says he would be a "willing student,” referring 
to the use of MCI, Sprint, Compuserve, and the 


Source, gives his address as 


A computer prj ith a_message from a Telemail 
account, from tol. This message 
discusses an 800 number used to access Arpanet. 

A computer printout listing the users of GTE. 


This list also has handwritten next to the user's 
name, what appear to be passwords. 


A telemail message, dated_Thursday, September 1, 
1983, from[ tof The message 
concerns how to use a computer system known as 
DEC-10. 


A white sheet of paper with handwritten notes 


on it. The notes show the name and the 

word Neal, next to the word Neal was 
password on Telemail. These notes also 

include the name and the term BIZCOMP. 


These are both user names and an account name 
that were used on Telemail. This sheet of paper 
also bears the name and the address 


was one of the frequent illegal 
users of Telemail. 


i6- 


AD 


b6 
bIC 


b6 
b7c 


be 
bIC 


be 
b7¢c 


be 
bic 


be 
b7e 


bé 
b7c 


b6 
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7 107) 


108) 


109) 


110) 


Lil) 


112) 
113) 
114) 


115) 


116) 


117) 


11 


A computer printout bearing one hundred and forty-three 
names and home phone numbers of various computer 
hackers. 


A pink sheet of paper with i cientific 

Users Group, and the number on 

it. This sheet of paper also contains words, b6 
"Death Valley Junction, California." It also BIC 


contains the prone numbers CL Jana 


A white sheet of paper bearing_the name 
Underneath that is the word b6 
number [and b7c 


sheet of paper aiso bears the address, 
A sheet of note paper bearin bé 
Lo 4 and telephone number b7C 


A sheet of paper bearing the term, "The United 
States Electronic Mail ter, Auqust, 1983. 
It also bears_the name be 


and she name 7c 


A typewritten booklet starting with the words, 
“Pfhis is the book on cheating the phone company." 


A typewritten booklet that begins with the words, 
"This is the paper on picking lever locks." 


A typewritten booklet that begins with the words, 
"This is the book on padlocks." 


A computer printout with one of the messages being 

to from Content b6 
of the message is, "Last night I logged into Telemail bmc 
and logged out to log in as another user. P.S. 

I was using the 800 number." 


A computer printout beginning with the words, 
"Codebreaker for the_Hayes Smartmodem. The second bé 
line bears the name} Be 


A computer printout with a message from 


to 


be 


The message states 
bI7C 


that the main reason is writing 
is so that[ _]Jcan look at this Telenet address: 
301162. 


Bake 


av 
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118) A blue homemade box containing a touchtone keyboard 
with wires exiting from the box. 


252. 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 


Qate of transcription. 


A review of the evidence seized pursuant t 
a Federal search warrant executed at bé6 
a the residence 6 b7c 


revealed the following items of interest: 


1.) A san/bar 400 F "relay circuit” that is 
labelled "property of the Bell System". 


2.) Two 400D KTU “relay board" also labelled 
“property of the Bell System". 


3.) A circuit board labelled 400 H RKTU, also 
labelled "property of the Bell System". 


1/10/84 Alexandria, Va. Alexandria 196A-633 
Investigation on at File 
‘ b6 
sal___________}sa3 L/i1/sa ‘ 
vy Date dictated _—- b7C 
This document contains neither recommendations nor conctusions of the FBI. It is the property of the FBI and is loaned to your agency: 


it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


2 1/16/84 


Date of transcription 


a computer programmer, examined 
i earch of bé 
the residence bIC 


found that the "disk interface" had 
arrived in a *non-operative"™ condition. stated b6 
that the disk interface had been modified and that without b7C 
that particular interface or one that had been similarly 
modified, none of the disks could be interpreted. 


1/10/84 . Alexandria, Va. Alexandria 196A-633 


investigation on Fi 


. b6 


Date dictated 
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Date of tronseription__1/31/8 4 


On January 24, 1984, 


a GTE-Telemail, provided a copy of the amount of money b6 
los y GTE Telemail from the unauthorized use by the hackers. b7c 


This document is broken down by user and by company. 


the hackers had tvo or more user names, 

owing will be a summary of the above document, 
be 

by 


therefo 
indicat 
(this s 
for eact 


y each user, combining multiple user names 
s the months of July, August and September 


USER COMPAN AMOUNT. MONTHS 


$62.29 July, August, 
September 


£31.C0 September 


| 16.00 August, September re 
$108.00 July, August 
Ls BMY $0,29 September 
$127.58 
| $2.00 September 
bé 


| RADA $1.00 September pic 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July be 
b7c 
Telenet $151.00 August 
jsolL_] 
Investigation on 1/25/84 a_Alexandria, Virginia rie e Alexandria 196A-633 


eS stk ont actana_1/25/84 bé 


b7¢c 
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Date of transcription 


subpoena —_ a 


b3 
b6 

b7C 

Further, GTE Telemail records show[ b6 
accessing the telemail system at 12:31 a.m. Eastern b7c 


Daylight Time through telenet dial-in number 405-232-4546. 


copies off 
trap and trace computer intouts and a hand-wr en b7E 
explanation provided by Eder attached 

to and incorporated within this report. 


2/2/84 Alexandria, Virginia Alexandria 196A~633 
Investigation on at File. Suh DP 
bE 
a co 2y2/t ore 
oy Date dictated 


This document contains neither 
it and its contents are not io be 


commendations nor conclusions of the FBI. It is the property of the FBI and is toanéd to your agency; 
rributec outside your agency 


EO 


pad 


AX 196A-633 


TABLE OF CONTENTS 


FOR REPORT FORMS (FD-302's) 


PAGE 
Summary of Activities on Telemail Cc 2 
| 3 
b6 
| 7 bre 
Co 8 


Co 11 


ae 


FD-302 (REV. 3-8-77) 


FEDERAL BUREAU OF INVESTIGATION 


a Date of vranseintion 2215/84 
lowL mmary of the activities 
of aka on GTE bé 
Telemail. BIC 


used the altas[_____} B6 
AND[_____ Jon GTE Telemail. b7c 


[LJwas the son responsi ting 
an illegal "node" taliedL (short for ) 6 


in RADA COMPANY. ‘This 1lllegal group has 26 different user BIC 
names registered. Each of these users was therefore 
able to illegally access the telemail system. 


later created an illegal "node" call 
[_}csot in the company CBOT. This node had five 


illegal users registered Finally, created ned 
an illegal "node" called MM in the MMM COMPANY. c 
This illegal "node" had five illegal users registered 
in it. 
is known to have accessed the telemail b6 
system in excess of 65 times between August 28, 1983, b7c 
and September 20, 1983. 
rap and trace records o 
bIE 
bé 
b7c 
Further, GTE records show 
system during that same time frame. 
tvestigation on 2/2/84 a Alexandria, Virginia ie 9 Alexandria 1964-633 
SA 2/84 6 
by A tre caw deraes__°/ 27 BIC 
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; bé 
~ 
hC?e b7c 
he Me {FEDERAL BUREAU OF INVESTIGATION 
i* Date of wanscriptionbecember 7, 1983 


At 8:15 a.m., agents of the FBI knocked on the front door 
| In their possession at the time was a Search warrant bie 


issued in the Western District of Oklahoma by the United States 
Magistrate, Ronald L. Howland for this address. 


Agents knocked on _ the door, which was opened by an individual 
who identified himself as was advised b6 
of the identity of the agents and the fact that they had a search b7c 
warrant for the premises. 
terin 


Upon en the apartment, the agents determined that 


was and that he lived in the apartment 
with his father, requested permission b6 
to contact his father_by telephone which was granted and Special b7C 
Agent{ > Jadvisea[. dover the telephone of the circumstances 
of their presence in his apartment. indicated that he 


would return to the residence upon the completion of the class he 
was due to teach. 


es given_a_ form titled "Interrogation; 

Advice of Rights” which he read.[SS—=sd'Sttatted that he would 

decline to_sign this form or anything else upon the advice of an be 
stated thath wh was an attorney b7C 


and contacted this person by telephone. CL then 
the agents that had advised him not to talk to the 


agents present. 


/# ,A-L2 


“Oklahoma City 
LOSA~L270, 


Fite # be 
b7C 


10/12/83 


Investigation on 


by 


Date drctated 10/12/83 
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NAME OF DEFENDANT: 


LS described as: 
Race & 


Sex s 
Date of Birth | y 
Social Security 
Account Number 
Height 
weight 
Hair 
Address 


b7C 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts of this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in this matter. 


2. On October 12, 1983, the premises located at 
was searched pursuant 
to a duly authorized federal search warrant and various 
computer paraphenalia were seized. 
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WITNESSES: 
1. 


GTE Telemail bE 
8229 Boone Boulevard bIC 


Vienna, Virginia 

Telephone |] 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


2. C= Bt 
Special Agent pre 


Federal Bureau of Investigation 


Can supply details of investigation. 


— Agent bé 


Federal Bureau of Investigation, Detroit pyc 


Can supply details concerning search ofl 
and details 


concerning use of a pen register on the home 
phone of Stajda. 


“Ld . 


BITC 
Can su details confirming that[ __]is 
concerning admissions made by[- ]to him. 


3/0 
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EVIDENCE: 

Note - Originals of pen register information, 
as well_as court order authorizing same are in possession 
of SAL sdséPBI. «Detroit. 

1. Copy of search warrant and attached affidavit. 
2. List of 20 messages left on Telemail b 
{originals are in possession of 
GTE Telemail). 


3. List of relevant items obtained in search (in 
possession of FBI Alexandria). 


4. List sn ane tol —=édioriginal 
) 


in possession of 


5. Report with information on authorization of 
pen register. 


3h 
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ee (@rrivavit FOR SEARCH warn @ 
OISTRICT 


Eastern District of Michigan 
Southern Division 


COCKET NO, 


NAME AND ADDRESS OF JUDGE! OR FEDERAL MAGISTRATE 


Wnuited States District Court 


. 53 MAGISTRATE'S CASE NO 
United States of America 


vs. 


The ae x as 


The undersigned being duly sworn deposes and says: That he/she has reason to believe that 
OISstRictT 


Eastern District of Michigan 


a rame Ouse bé6 


b7c 


Barbara K, Hackett be 
1019 Federal Building bic 
Detroit, Michigan 48226 


on the person of & on the premises known as 


| The following property is concealed: “.: 


computers and computer associated devices such as modem, CRT 
terminals and keyboards, printers, disc drives, tape drives and 
other input/output medium; magnetic media including but not 
limited to magnetic tapes, discs (hard or floppy); all output 
produced by or caused to be produced by a computer including 
printer output, teletype output or paper tape output; ail notes 
Affiant alieges the follows ounds, for search end seizure2 : SEE ATT! 


E& See attached affidavit which 1s incorporated as part of this affidavit for search warrant 


Affiant states the following facts establishing the foregoing grounds for issuance of @ Search Warrant 


seh 


SEE ATTACHED a am 
ad rie 
SIGNATURE OF AFFIANT OFFICIAL TITLE, 1F ANY 


Special Agent, F.B.I. 


JUDGE) OA FEDERAL MAGISTRATE 


October 11, 1983 Barbara K. Hackett 


United States Judge oF Judge of # State Court of ecors, 
21f @ search is to be authorized “at any time in the day oF night” pursuant to Federal Rules of Criminal Procedure 41 (cl, show ressonabie couse therefor. 


ze 3/A 


Papers, notebooks, Or any Other type of Fecords 8S8S0ciateg 


8, United States Code, Section 1341, and COnpSiracy to commit 
Wire fraug and or Mail fraud, in Violation Of Title 18, United 
States Code, Section 371, 
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@ e 
AFFIDAVIT IN SUPPORT OF SEARCH WARRA™ | 


The undersigned being duly sworn deposes and say: 


I 

Affiant,[ sd is a Special Agent with the reo 
Federal Bureau of Investigation and has been so employed for 
four years. Affiant is assigned to investigate allegations 
of violations of federal criminal laws including 18 «U.S.C. 
61341 (mail fraud), $1343 (wire fraud), 81362 (wilful interference 
with means of communications controlled by the United States, 
and 6371 (conspiracy to commit fraud by wire). Affiant has 
received a certificate after completion of a month long course 
in computer related fraud at the FBI Training Academy. For 


ne i has been assigned to monitor 


ae 
al 
° 
* 
ra 
a 
iy 
wr 
o 
te 
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o 
a 
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o 
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th 
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ap 
computer bulletin boards. A computer bulletin board as referred 
to in this affidavit is nothing more than a small capacity com- 
puting device (including CRT terminals and keyboards), such that 
are commonly available on the retail market, a modem, or a device 
that allows data communication to pe sent over a telephone line, 
and some kind of data storage device connected to the computer 
(including magnetic tapes and/or hard or floppy discs). Fre- 
quently, the operator of a “bulletin board” will have a small 
CRT screen and a printer as well. 

A bulletin board program as referred to in this affidavit, 
is merely a set of data instructions to a computer, either pre- 
purchased or devised by the user, which allow the collection of 


devises described to function as a “computer bulletin board.“ 


x 


Sal 


Bld 


eo e 


The “computer bulletin board" functions as a medium of informa- 
tion exchange for other persons who likewise own computers. To 
use a “computer bulletin board", a person dials the associated 
telephone number of the board to be contacted and waits until a 
data tone is heard. Then the call is electronically or acousti- 
cally coupled to the caller's computer. Now, the caller may 
peruse information files, leave messages, or even "converse" by 
keyboard with the person at the opposite station. 

The vast majority of dial-up computer bulletin boards are 
legitimate in nature, and serve the needs of the avid computer 
hobbyist or conversant. Some serve as forums or meeting places 
for various sexual activity or esoteric thought or inclination. 


Others, referred to as “hostile” bulletin boards, offer a medium 


of exchange for illicit, cri 
at Telecommunications Common Carriers and operators of large 
nationwide computing services. 

While one may set up a computer bulletin board with inexpen- 
sive equipment and a modicum of computing knowledge, many have 
reached the sophistication of more advanced systems by requiring 
passwords in order to access data and leave messages. 

Through his training and experience, your affiant is aware 
that computer bulleting boards have varying degrees of security, 
which is to say, some subject matter may be accessible to the 
casual caller while the operator of the computer may allow only 
certain callers with “passwords” or “codes" to peruse and leave 
more sensitive and illicit data and information. The operator 
of a hostile computer bulletin board may demand some illegal or 


tt 
es 


BIS” 


oe ce 
illicit information from the caller as a sign of good faith 


before access is granted to the more sensitive data files. 
Ir 


Affiant has learned from officers and employees of GTE 
Telenet Communications Corp. (GTE) at operations headquarters 
in vienna, Virginis, through conversations with special agents 
of the Federal Bureau of Investigation that GTE owns and operates 
a computer network known as Telenet which links various sub- 
scriber companies and government agencies, through a tie-in 
system, in numerous cities. GTE is a Telephonic Common Carrier, 
regulated by the U.S. Government, which operates as follows: 
First the user dials a local and usually toll-free access number. 
A tone, analogous to dial tone, is returned to the caller. Next, 
the caller dials in an access code provided by the common carrier. 
Finally, the caller dials in the telephone number to be called. 
Computerized billing equipment owned by the common carrier auto- 
matically times the call and bills it to the person whose access 
code was used. The use of a Common Carrier Access Code is similar 
to the use of a telephone company credit card. Common carriers 
Cannot at this time determine the origination point of calls 
placed through their facilities, only the destination points. 
Common carriers, therefore, are only aware of fraudulent and 
illegal use of access codes after the legitimate customer informs 
them after the legitimate customer receives a bill by mail. 

Recently (since mid-August of 1983) it has. come to the atten- 
tion of GTE that computers of certain Telemail subscribers have 
been accessed by a group of intruders. The intruders, some of 

A 
aoe 
74 
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whom appear to have banded together in groups known as “Inner 
Circle", “Operation Circle" and “Phalsers" have gained access 
to certain subscriber administrators and established pirate 
“bulletin boards" within the subscriber system, as well as 
browsed through subscriber files. These "bulletin boards" 
have been established without the subscriber's knowledge or 
consent. 

Once it was determined that certain Telemail customer 
files were being infilitrated, GTE was able to retrieve 
messages posted on the pirate bulletin boards and determine 
that traffic between “Inner Circle” members discussed on 
August 15, 1983, an operation known as “Ultimate Rip-off". 

In one of the messages on the bulletin board on August 15, 

1983, a subject calling himself[___—sinoted to a subject 

calling himself[ _————sdthhat hel ——=édsi picked the 

wrong system because code 21256 is a demo system and “you can't ere 
really do anything with it".[——siiadvisea[L—sdte 

was supposed to get into system C-21267. FBI investigation has 
revealed that both account number 21256 and 21267 are Telemail 
accounts assigned to Citibank, New York, N.Y. Another message 

on August 15, 1983, asks the question “Who is going into the 

banks and pick up the money." 

On late afternoon August 25, 1983, GTE advised the FBI at 
Alexandria, Virginia, that a further review of their system 
has uncovered other intruders not previously discernible to 
GTE which indicates that this intrusion problem is far more 
widespread than previously thought. GTE has been able to 

oe 


a ‘®@ 


retrieve a number of pirate messages which reflect the intruders 
sharing information giving directions for access to other 
systems as well as the GTE system. 

Recently, it has come to the attention of GTE that the 
accounts of approximately eighteen Telemail subscribers have 
been accessed by unauthorized intruders from different areas 
of the country. The intruders have gained access to certain 
customers’ Telemail subscribers accounts by determining pass- 
words assigned to Telemail subscribers through a process called 
"hacking". In this process, a “hacker” chooses a subscriber 
account such as Raytheon, NASA, USDA, RADA Corporation, Coca 
Cola USA, 3M Corcoration, The "hacker" then begins to try 
numerous successive passwords (e.g., each letter of the alphabet, 
oer the administrator's first name, etc.) until the correct pass- 
word is discovered. Many hackers program their home computer to 
systematically try passwords for hours at a time. Once a hacker 
has broken a terminal's password, he can now enter the Telemail 
system as if he or she were the legitimate subscriber. The 
hacker would do this by calling any published Telenet dial in 
number and then placing his or her telephone on a modem hookup. 
This modem hookup now allows the hacker to type on his or her 
home computer keyboard and have the impulses sent through the 
telephone system into the Telenet computer system. The hacker 
then types in the command “Mail" and enters the Telemail mailing 
system. At this point the computer prompts the hacker with "User 
Name?". He or she then types in the words (for example) ADMIN/ 


NASA. The computer then promptswith "Password?" and the hacker 


j. 
--t- Bly 
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then types in the password that he or she has discovered through 
hacking. At this point the hacker is accepted by the system as 
a legitimate subscriber, and may perform many of the functions 
that the subscriber can perform, all of which would be charged 
to the legitimate subscriber. At this point the hackers create 
a pirate subdivision in the legitimate subscriber organization, 
such as ADMIN/inner circle/NASA and then set up user names in 
that new "pirate" account. User names may be any compilation 

of letters and numbers but are usually a first initial, period, 


i a bé 
then last name Gee.w> sd’ The hacker, as administrator BIC 


of his or her own subdivision, now sets up passwords for all 


users, notifies them of their user name and password 
ang they can now enter Telemail with their names and passwords. 
These users may then leave messages on the system to an individual 
in the group, to the pirate administrator or (because the computer 
believes they are legitimate} to any other user (legitimate or 


illegitimate} in the entire Telemail system. 


Irt 


Affiant has learned from FBI s/aAL_SSSS—=idiatt on 


approximately August 23, 1983 GTE Telemail discovered the 
unauthorized usage of customer accounts of American Hospital 


Services Corporation {AHSC) and Raytheon Company by a person(s) BIC 


This person(s) was (were) using Telenet Dial inD sid 


andl —=*@dS This person has entered the accounts of 


Telemail customers without authorization in excess of sixty (60) 


times from August 23, 1983 to September 24, 1983. 


-@ ©@ 
Iv 


Affiant has learned frqm Michigan Bell Telephone Company 


bé 


CL} which affiant has discovered is a two story, white BIC 
frame house located on[__ 


Vv 


On September 24, 1983 a confidential source, who has pro- 
vided reliable information in the past, which information has 
been confirmed by Special agentL sd FBI, and who on “a 
one occasion gave information which lead to an arrest, told 
( 


(subsequently, the source was pre 


vi 


bB7C 
that Raytheon Company's account on Telemail was in fact terminated 


by an unauthorized user on August 29, 1983. This information was 
not released to anyone outside the Raytheon Company or GTE Tele- 


mail. 


a 
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VII 


On the basis of a court order signed by United States 
District Judge Avern Cohn, Eastern District of Michigan, 
Southern Division, a pen register, a device which records 
the number dialed from a particular telephone was placed on 
bTE 
VIII 


on October 11, 1983 your affiant confirmed that from 
August 23, 1983 to October 6, 1983, Telenet account numbers 


313/964-2813 or 313/964-5538 were called at least sixty (60) 
bé 


Due to the continuing nature of the offense, that is the 
devising of a scheme or artifice to defraud GTE, AHSC and 
Raytheon Corporation through the use of computers and computer 
related equipment over a telephone at a given location your 


affiant believes that the fruits and instrumentalities of said 


. be 
exime will be found ac[ Bre 


x1 


Based on all of the above facts, your affiant submits that 


there is evidence of an ongoing offense located at the premises 


bé 
in the Eastern District of Michigan. At that location are 


er 


ett 
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computers and computer related paraphernalia records, docu- 
ments, papers, and notes which are the fruits, evidence and 
instrumentalities of an offense against the United States, 

that is wire fraud in violation of Title 18, United States Code, 
Section 1343, mail fraud in violation of Title 18, United States 
Code, Section 1341 and conspiracy to commit wire fraud and/or 
mail fraud in violation of Title 18, United States Code, Section 


371. 


— —_—— —— 6 
Special Agent bic 


Federal Bureau of Investigation 


SWORN TO before me and 
SUBSCRIBED in my presence 


this lith day of October, 1983. 


UNITED STATES MAGISTRATE 


BPA. 


— 


Boe a f 


99 
ae ‘67021 


DISTRICT % 
Eastern District of Michigan 


UNITED STATES OF AMERICA 
ve 


The = known as “d 


PeDR2af} (on the premises known as) 
Ppecaficall described as a two stor 


TO: 
Any Special Agent of the Federal 


Bureau of Investigation or any 
duly authorized law enforcement 
officer 


named affiant that he/shwphas reason to beliave that (en ihe 


bé 
b7c 


in the. Eastern District of Michigan there is now being 


concealed certain property, namely computers and camputer associated devices such as modem, 

CRT terminals and keyboards, printers, disc drives, tape drives and other input/output 
medium; magnetic media including but not limited to magnetic tapes, discs (hard or floppy}; 
all output produced by or caused to be produced by a computer including printer output, 
teletype output or paper tape output; all notes, papers, notebooks, or any other type 

of records associated with or related to computer usage, including address hooks, desk 
diaries, diaries, directories or any other device used to record information, addresses, 


books, papers, 1 Ss and records which are the fruits, evidence and instrumentalities 
of crime against the United States, that is, wire fraud, in violation of Title 18, United 
States Code, Section 1343, mail fraud, in violation of Title 18, United States Code, 
Section 1341, and conspiracy to commit wire fraud and or mail fraud, in violation of 
Title 18, United States Code, Section 371. 


Paton > 
see 
\ Hi 
j J 
and as | am satisfied that there is en eer see the property so described is being concealel 


person or premises above-described and the grounds for application for issuance of the search warrant exist 
Stated in the supporting aftidavitts), 


YOU ARE HEREBY COMMANDED to search on or before of 
(not to exceed 10 days) the person or place named above tor the property specified, serving this warrant and making 

the search (in the daytime — 6:00 A.M. to 10:00 P.M.) (atanytimein-the-day or night)* and if the property be found 
there to seize it, leaving a copy of this warrant and receipt for the property taken, and prepare a wnitten inventory of 

the property seized and promptly return this warrant to__Magistrate Barbara Hackett 

as required by law, “rw Weve or US Maguerane 

Pett 393 b6 


SIGNATURE OF JUDGE OR US MAGISTRATE OATE/TIME ISSUED bIC 


finn 1, thee Ot Otepe oH) 978 I 


“it a search is to be authorized “at any time in the day or night” pursuant to Federa! Rules of Criminal Procedure Rule 41(c), show reasonable 


‘€ WARRANT RECEIVED 


10/11/83 


INVENTORY MADE IN THE PRESENCE OF 


INVENTORY OF PROPERTY TAKEN PURSUANT TO THE WARRANT 


One Atari 400 home computer serial # 020388 


Atari 410 datarecorder serial # T 48534 
Atari 850 serial interface serial # AN 146902 
Bizcomp versamodem serial # B 003948 
One KMC color television set serial # 20505492 
One tan princess telephone 
Ten data casette tapes 


Two boxes of misc. papers 


v. 


CERTIFICATION 


1 swear that this inventory is a true and detailed account of all the property taken by me on the warrant. 


/s/ 


Subscribed, sworn to, and returned before me this date. 


/s/ Barbara K. Hackett 


10/13/83 


r— 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription. 1/5/84 


The following is a summary of messages left 
by the illegal user on GTE Telemail. The date bé 
and time of each message is provided, with a synopsis pie 
of particularly significant messages included. 


1.) August 15, 1983, 3:19 PM. This message 
reads as follows: you picked the wrong system 
we are supposed to get into C 21267...because 21256 


is a demo system of some sort you can't really do anything Peo 
with it. Here is the user name and password, User 
name = Bank; Password = Bank. That password is to 
C 21256. Have_phun! Was I supposed to post that up 
here? Signedf For information C 21267 is 
the Telemail connect address for Citibank in New York 
city. 
2.) August 16, 1983, 10:43 AM. 
3.) August 18, 1983, 11:17 AM. This message 
concerns how to illegally access Wats lines. 
4.) August 17, 1983, 11:04 AM. 
5.) August 18, 1983, 11:26 AM. 
6.) August 14, 1983, 10:24 AM. 
7.) August 14, 1983, 4:45 PM. 
8.) August 15, 1983, 3:17 PM. The subject 
of this message is “Ultimate Rip-off". Text of the 
message is as follows: "It may work or it may not, 
depends on what happens. Q-Who is going to go into 
the banks and pick up the money? OQ-If we don't do 
it the way where yo © pick up the money in the 
bank where...Signed . 
9.) August 16, 1983, 10:50 AM. 
10.) August 18, 1983, 11:07 PM. 
12/8/83 Alexandria, Va. Alexandria 196A-633 
investigation on. at File @ 
bé 


sa Ja 12/9/83 bie 


by Date dictated 


This document contains neitner recommendations nor conclusions of the FBI. It is the property of the FBI and is toaned to your agency: 
it and its contents are not to be distributed outside your agency. 
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August 16, 1983, 3:08 PM. This message 
is from to Subject is "Admin listing" 


The text of the message is "Here is a Admin listing~-Admin/IBMLEX, 


P = IBMLEX; Admin/Michigan, P = A; Admin/Unix, P = 
Angela; Admin/Amnet, P = Bill; Admin/CCUSA, P = Mary; 
Admin/CWP, P = CWP; Admin/Ra theon, P= Lou. Purge 
this message. Signed 


12.) August 18, 1983, 9:10 PM. Subject 
is "Telemail Accounts". Text of the message is “Here 
is some accounts that I created from the other Admins 
accounts...Company user name password..IBMLEX, P. Phreind, 
Phred. CCUSA, M. Mikey, Phred. Unix, J. Crack, Phred. 
Michigan, Dr. Zaphod, Phred. Amnet, A. Phreedmon, 
Phred. Raytheon, J. Jackson, Phred. Telemail, H. Frem, 
Phred. JPL, J. Cargo, Phred. LERC, J. Darda, Phred. 
NSTL, S. Shuttle, Phred.... These are accounts that 
I created using the Admin's passwords to the companies. 
Signed 


13.) August 19, 1983, 8:29 PM. This message 
concerns instructions about how to illegally access 
the computer system known as Dialcom. 


14.) August 20, 1983, 11:14 AM. This message 
also contains instructions on how to access Dialcom. 


15.) August 21, 1983, 1:46 PM. This message 
contains ITT Dialcom passwords. 


16.) August 23, 1983, 12:12 PM. 


17.) August 27, 1983, 2:23 PM. This message 
is titled “Welcome to Bizcomp". The text of the message 
is as follows: "Welcome to the new age of bulletin 
boards. I am the Sysop of the phantsy BBS so if you 
have any remarks about the board or need help on how 
to use it just sent mail to that is me otherwise... 
Signed 


18.) August 30, 1983, 4:37 PM. This message 
reads in part "To go undetected in the system I use 
regular user names such as E. Smith or other names 
that are common. 


BE’ 


be 
b7Cc 


b6 
b7Cc 


bé 
b7c 
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19.) August 30, 1983, 4:40 PM. This message 
is from the node Triplex told The 
text of the message Is as follows: "I set these accounts 


up with little power of sending so it may work, but 
whatever. sf |" 


20.) September 3, 1983, 3:07 PM fhe text 
of the message is "Is felemail going unused? Please 
lets s stem going a bit..O.K. 
Signed Telemail--Sysop." 


BA7 


be 
bic 


b6 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 


12/5/83 


Date of transcription. 


This 302 reflects a review of evidence seized 
pursuant to a duly au i b6 
the location known as bre 
a ie “ 


The following is a summary of paper materials 
and print-outs that are relevant to this investigation: 


1.) Three hand-written pages of names and phone 
numbers beginning with} = 
This list also contains, among others, the names and numbers be 
aieeerre—_—— oes pre 


2.) A long computer print-out containing the 
connect addresses, official name, computer type and system 
type of numerous computer networks, including Arpanet and 
Milnet. 


3.) Thirteen sheets of hand-written notes containing 
Arpanet connect addresses, Milnet connect addresses, Telenet 
connect addresses. Hand-written notes concerning Mitre 
Corporation with a listing of nine user names followed 
by the passwords for each user name. These notes also 
contain numerous other host computer systems and their 
telephone numbers, including Michigan National Bank, Hartford 
College, Arizona State, National Institutes of Health, 
First National Bank of America, J. C. Pennys, Credit Link, 
Sears Credit Line, Union Oil, and F. A. A. 


4.) A sheet of paper with hand-written notes 
concerning Mitre Corporation. This page lists 13 user 
names and passwords associated with Mitre Corporation. Mitre 
Corporation is a host on Arpanet and Mitre Corporation 
is engaged in sensitive Department of Defense research. 


11/17/83 Alexandria, Va. Alexandria 196A-633 Sub¢ 
snvestigation on at File « 
b6 
Ss. ay 11/17/83 BIC 
6 saf sas oate sites 11/2 7/ 
This document contains neither recommendations nor Conclusions of the FSI. It is the property of the FBI and is loaned to your agency; 
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5.) A sheet of paper with hand-written notes 
en it. These notes refer to McClellan and contain four 
user names with their passwords. McClellan is a United 
States Air Force Base that is a host on the Milnet network. 


6.) A packet (stapled together) of seven pages 
containing hand-written notes. These notes cover a variety 
of topics, including listing calling card numbers. These 
pages also list numerous Telemail user names and passwords, 
including ~Skylab", and the following listing: 


IBMLEX = P. Phreind Password = Joke 
CCUSA = M. Mikey Password = Joke 
UNIX = J. Crack Password = Phred 


Michigan = Dr. Zaphod Password = Phred 
Amnet = A. Phreedmon Password = Phred 
Raytheon = J. Jackson Password = Phred 
Telemail = H. Frem Password = Phred 


JPL = J. Cargo Password = Phred 
LERC = J. Darda Password = Phred 
NSTL = S, Shuttle Password = Phred 


Other hand-written _notes on this series of_sheets 
of papers include the words[ _—sad#A’sSImnerccircle, 
eal =e Another note lists the word Admin/CCUSA, 
followed by Password = Mary. There is also a listing of 
Admin/CWP, Password = CWP, and the words Admin/Raytheon, 
Password = Lou, Hand-written notes also include the name 


= 42739. This is followed 
by the note = Tt 223 N = Transmit. This is followed by 


the nane( = 3242. the above 
names and numbers are associated with the number 1~800~426~2222. 


7.) A sheet of paper with hand-written notes 
containing various Telemail hosts, user names and passwords 
as follows: Jobs/AHSC, User = Password = COBE; OSF/NASA, 
User = Password = Skylab; UNACRX/Telemail 


User = Password = Apple; Cc er = 
Password = A; Admin/Finance, User = Password = A. 


8.) A sheet of paper with hand-written sh a 


followed by the address 
This sheet 


aise See | the name followed by the phone number 


334 


b6 
bIC 


b6 
b7c 


be 
b7c 


be 
b7Cc 
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9.) A sheet of paper with hand-written notes 
labelled Telemail Notes, followed by the listing of numerous 
host companies on Telemail, such as NASSA, CCUSA, Raytheon, 
IBMLEX and approximately 30 others. 


10.) Two sheets of paper with hand-written notes 
labelled Arpanet-Notes. These notes consist of connect 
addresses and host names. 


11.) Two pages of hand-written notes listing 
approximately 50 Telemail users and passwords. The companies 
involved are Coca Cola, USA, NASA, Ford, and a company 
listed as GSFC. 


12.) A sheet of paper with the hand-written words 
Innercircle. 


13.) A sheet of paper with hand-written notes, 
includ. he following Telemail host systems: __Jobs/AHSC 
User = Password = Code; OSF/NASA, User_= be 
Password = Skylab; UNACRX/Telemail, User = assword B70 


= Applez r= Password = A; CCUSA, 
aaa Password = A; Admin/Finance, User = 
Coy assword = A. 
14.) A sheet_of paper with a hand-written list 
is is a listing B76 


of the users of the illegal node in Telemail known as 


the Innercircle. This sheet of a also bears the name 


15.) A sheet of t fer with the hand-written notes 


including the word followed by the_number 
This i my and the be 
name is an employee Pig 
of GTE Telemail. 
16.) A sheet of paper with hand-written notes 
as follows: Admin/Trinex Admin/GTE 
This is followe y the word Triplex and 
then the word followed by the word Fone. This be 
is followed by the word Admin/Triplex, followed by the b7c 


letters FGFGE. The preceding two sets of names were user 
names and passwords in an illegal file in GTE_Telemail. 


t of pa ins the words 
and 


Beto" 
aod 
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17.) A sheet of paper concerning a listing of 
user names and passwords as follows: Admin/Bizcomp, Password 


Dead; Password Fone; Password DOD: bE 
P A Password BIC 


Password Password Red. 


18.) A re-print of the Global Autovon Telephone 
Directory. 


33! 
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FEDERAL BUREAU OF INVESTIGATION 
oste ot ranseriorion__1/31/84 


On January 24, 1984, 


Ct GTE-Telemail, provided a copy of the amount of money bé 
ost by GTE Telema1ri from the unauthorized use by the hackers. bic 


This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
{this summary covers the months of July, August and September 
for each company}: 


USER COMPANY AMOUNT MONTHS 
Cd AHSC $62.29 July, 
Septem 
UAW £31.00 September 
| narave $16.00 august, Septenbes 8 
Maraven : ugust, September poe 
Telenet $108.00 July, August 
| BMW $0,29 September 
$127.58 
| CBOT $2.00 September bé 
b7Cc 
| RADA $1.00 September 
$3.00 
| Maraven $24.00 August b6 
b7¢c 
Telenet $325.00 July 
Telenet $151.00 August 
SUBS 
investigation on 1/25/84 a Alexandria, Virginia cies Alexandria 196A-633 
be 
SA sfk Date aictatea 1/25/84 bic 


vy 
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FEDERAL BUREAU OF INVESTIGATION 


Oate of transcription_8/ 19/23. 


was served with a Federal Court Order on 8/19/83, requesting 


her organization to assist the Federal Bureau of Investigation with b6 
the_installation of pen is or dialed n i ipment pe 


The court order will expire inD sien an extension bIE 


is obtained. 


ee 


7 
invatigtion on_8/19/83 oe ey ee 


b7C 


ee ll 
vy_SAl te oretatea__ 8/19/83 
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FEDERAL BUREAU OF INVESTIGATION 


-i- 9/13/83 


Date of transcription. 


opP advised safe 


the following: BTC 


be 
b7c 
b7D 


be 
bICc 
BID 


Source stated that 


ce stated that 


be 
bICc 
BID 


“Kiexandria .19GA-633 


ntnnen 913083 (a )_,, Botrot 28-887. 53 
* bE 
sao 9/9/83 ee 


by. Date dictated, 
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FEDERAL BUREAU OF INVESTIGATION 


L Oate ot teamteriotion__ 2/10/84 


This is a summary of the activities of[_] 


[C7 Jon ctz telemail. bs 
b7C 


on GTE Telemail. 


was an illegal user as part of the group 
called "INNERCIRCLE" in AMERICAN HOSPITAL SUPPLY COMPANY bé6 
(AHSC), and in RAYTHEON company. [_ created an illegal 


b7C 
“node" called "BIZCOMP" in RAYTHEON COMPANY. 
to a confidential source that b6 
b7C 
b7D 
routinely provided the user names and 
passwords of legitimate Telemail administrators to other b6 
hackers, giving out as many as seven at one time. He bre 
also created many illegal accounts and provided these 
user names and passwords to other hackers, giving out 
as many as ten at one time. 
also routinely accessed another Telenet be 
host system known as ARPANET (ADVANCED RESEARCH AND PLANNING bre 
AGENCY NETWORK). This is a system designed and set up 
by the DEPARTMENT OF DEFENSE to provide a system for transfer 
of information by companies doing defense related research, 
some of it classified. 
is known to have accessed the Telemail b6 
system at least 25 times between August 15, 1983, and b7C 
September 5, 1983. 
Investigation on 2/6/84 at Alexandria, Va. rie Blexandria 206A-633 
b6 
| e772 bre 


Thig document contains neither recommendations nor conctusions of the FBI. It is the property of the FBI and is loaned to your agency: 
it ang its contents are not to be distribute outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


PROSECUTIVE REPORT OF INVESTIGATION CONCERNING 


be 
also known as bic 
FRAUD BY WIRE; CONSPIRACY 


Copy to: 1 - USA, Alexandria, Va. be 


FBI/DO4 
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NAME OF DEFENDANT: 


Rags, 

Sex s * b6 
Date of Birth Cy bre 
ferght 

New York | 

New forte 


Driver's License 
a 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 

2 On October 12, 1983, the premises located at 

was searched pursuant 
to a duly authorized federal search warrant and various 
computer paraphenalia were seized. 


B46 


b6 
BIC 
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WITNESSES: 


» [|__| 
GTE Telemai 


8229 Boone Boulevard 

Vienna, Virginia 

nelephonet— | 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


Special Agent 
Federal Bureau of Investigation 


Can supply details of investigation. 


» 
Specia gent 


Federal Bureau of Investigation 


Can Supply details concerning search of CL siédzd 


Can supply details concerning true 
identity as Lana use 


of Telemail. 


Full text of interview pages 3 - 4, attached. 


Can supply details of phone conversationg with 
Dp Pakal fat nome phone of] 
“tet 


BY7 


bé 
b7¢c 


b6 
b7c 


be 
b7c 


be6 
b7c 


bé 
b7c 
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EVIDENCE: 

l. A seven-page typed paper with the a 
appearing throughout (origirial in possession of FBI Alexandria). 

2. Thirty-six messages left by on the 

i em (original in possession o 

GTE Telemail). . 

3. Copy of charges accumulated_b on GTE 
felemail (original in possession of . ; 

: Cons af a warrant and affidavit torL_] 


1 Bye 


be 
b7¢c 


be 
b7c 


be 
b7C 


b6 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 


1/5/84 
Date of transcription 


The following is a summary of messages left bé 
by the illegal user using the nane[ Jon GTE bre 
felemail. The date and time of each message is provided, 


with a synopsis of particularly significant messages 
included. 


1.) August 14, 1983, 11:57 AM. 


2.) August 14, 1983, 12:11 PM. The subject 
of this message is “Trace, Security". The text of 
the message reads in part “We might have a problem. 
There's a good chance that my phone is tapped. Regardless 
we might have to be more careful. Call it paranoia, 
but I think someone is out to get all of us." 


3.) August 14, 1983, 1:47 PM. 
4.) August 14, 1983, 2:12 PM. 
5.) August 14, 1983, 4:31 PM. 


6.) August 15, 1983, 4:02 PM. This message 
reads in part "At the conference tonight we will discuss: 
Cosmos, Ult Rip-off, Blu-Stuff." 


7.) August 15, 1983, 4:08 PM. This message 
reads in part "Over the telephone voice calls: Don't 
say anything phreak-related after today! Reasons: 1.) 
There is no reason to because we will have our hands 
full with cosmos and banks for the ult rip-off; 2.) 
We can go "data™ instead of voice; 3.) We don't want 
to spread around a lot of info for security reasons. 
The more people that know the less chance of safe success.* 


8.) August 15, 1983, 11:59 PM. 
9.) August 17, 1983, 8:47 PM. 


10.) August 14, 1983, 1:59 PM. 


12/8/83 Alexandria, Va. Alexandria 196A-633 
Investigation on a fie @ 
b6 
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by Date aictated 
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11.) August 17, 1983, 2:54 PM. 
12.) August 17, 1983, 8:39 PM. 
13.) August 14, 1983, 12:47 AM. 
14.) August 14, 1983, 11:49 AM. 
15.) August 14, 1983, 2:04 PM. 
16.) August 15, 1983, 6:33 PM. 
17.) August 15, 1983, 8:09 PM. 
18.) August 17, 1983, 8:43 PM. 
19.) August 17, 1983, 8:53 PM. 
20.) August 18, 1983, 8:33 PM. 
21.) August 19, 1983, 12:28 AM. 


22.) August 20, 1983, 10:48 PH. fhe text 


of this message refers to the user name followed bE 
by Other information indicates 7c 
is of the Osuny bulletin board. 


23.) August 20, 1983, 11:07 PM. 

24.) August 21, 1983, 1:01 PM. 

25.) August 21, 1983, 1:03 PM. 

26.) August 21, 1983, 6:13 PM. This message 
is titled "Teleconferencing Numbers". The text of 


the message is as follows; “Here are the girls' numbers 
d the test: 


be 
b7C 


That's ali." 


27.) August 21, 1983, 8:25 PM. 


24D 
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28.) August 21, 1983, 8:27 PM. 
29.) August 22, 1983, 9:03 PM. 


30.) 
is addressed to 
tne message i i 
signed 


August 


MH. This message 
The text of 

The nessaege_is 

dentified as 

mber obtained for the user name 

bscrined to by a person named 


b6 
b7c 


er 


Fa au 23, 1983, 5:45 PM. This message 


33.) August 24, 1983, 3:31 PH. 
34.) August 24, 1983, 3:36 Pia. 
35.) August 24, 19 


36.) August 24, 1993, 4:53 PM. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcristion 1/31/84 


GTE-Telemail, provided a copy of the amount of money b6 


Tost by GTE Telemail from the unauthorized use by the hackers. b7C 
This document is broken down by user and by company. 


Many of the hackers re user names, 
therefore the following will 2 y of the above document, 
indicating tetals by each user, combining multiple user names 
(this summary covers of July, August and September 
for eacn company): 


“oun MONTHS 


wo 
i 
tw 
feed 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July b6 
b7C 
Telenet $151.00 August 
rs 
investigation on 1/25/84 a Alexandria, Virginia cree Alexandria 196A-633 
bé6 
bIC 
by SA sfk Date dictate 1/25/84 
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"Foro A. 0. 99 (Rev. Ape. 1979) . arch Warrant 


United States 


FOR THE 


Southern District of New York 


UNITED STATES OF AMERICA Docket No. 


Case No. 


THe PREMISES KNOW 


SEARCH WARRANT pyc 


| . 
| 


To hny Special Agent cf the Federal Bur 
of Investigation or any duly autror2 
Affidavitts) having been made before me by Special heer 


be 


that he hus reason to believe trat { bre 


| 


inthe .Sor 


ern District of New Yori 


there is now being concealed certain property, namely comourer 
devices such as modem, CRT terminals and i : 
tape drives and other input/ourput medi: 
limited to magnetic tapes, discs (hard 
or caused to be produced by a computer 
output or paper tape output; all notes, i er any 
of records associated with or related to cerputer usage, including 
books, desk diaries, diaries, directories or any cther device used to record 
information, addresses and business deslings of unauthorized usaar or users 
of computer networks; and olher books and records rich are 
the fruits, evidence and instrumental against the United 

States, that is, wire fraud, in violation of Title 18, United Stetes Code, 
Section 1343. 


and as I am satisfied that there is probable cause to believe that the property so described is being 
concealed on the person or premises above described and that grounds for appiication for issuance of the 
search warrant exist ag stated in the supporting affidavit (a). 


You are hereby commanded to search within a period of .. tem _(10.).cdays.____.- ele 
(not to exceed 10 days} the person or place named for the property specified, serving this warrant 
in the daytime (6:00 a.m. to 10:00 pm.) | 
BEAD K RPO DIMNE MINK BH MIHEK XX XKKX | 
there to seize it, leaving a copy of this warrant and receipt for the property taken, and prepare & wri 
inventory of the property seized and promptly return this warrant and bring the property before 
wae ne ee ee ee ne ne ee ee eee eee eee ag required by law 

Federal fudgs oF mayinirare 


and making the search and if the property be found 


Dated this day of October 19 83 


Judee (Federal of sate Court of Record) or Federel Mngustrave 


*The Federal Tuiles of Criminal Procedure provide: “The warrant chail be served in the cavume. entess the usuine authority. tr aroregtiate prosior 
Ja the warrant, sné tor reatorapie Cause shown, RUTPOF es Hk EreCUUIOR at Umed Cine (an cavumie” (Rule alter) A nate Wettraeety 
tonadle cause should be mace in (he affrgaviltay If aw searcn #4 10 be RUINOTIZEG “AL any Time aay cr mygri pUIsuAR: to hule alic), 

% 
Fett r 


AFFIDAVIT. IN SUPPORT OF SEARCH WARRANT 
Your affiant, « », isa 
Special Agent with the Federal Bureau of Investigation and has 
been so employed for years. Your affiant brings this 
affidavit on information he has received from his personal 
investigation, from information received from Special Agent 


Lana from persons your affiant knows to be ve 


reliable and trustworthy. 


INTRODUCTION 


General Telephone and Electronics (GTE) owns and 
operates a computer network known as Telenet which links 


various subscriber companies and Government agenices through 


@ tie-in system in numerous cities throughout the United 
Access is obtained by calling a published telephone number in 
various cities. 

Within the Telenet System is a service called Telemail 
which offers a computerized message capability between Telemail 
customers and any Telemail subscriber company. Each Telemail 
susbscriber is responsible for designating an "in house” 
administrator to oversee all administrative functions of 
the customer's Telemail service, including the assignment of 
Passwords to gain access to the system and the subscriber 
company. The administrator for a new user company may set up 
various subdivisions and indvidual users in his own ccmpany as 


he sees fit. 


Recently, it has come to the attention of GTE that the 
accounts of approximately eighteen Telemail subscribers have 
been accessed by unauthorized intruders from different areas 
of the country. The intruders have gained access to certain 
customers’ Telemail subscribers accounts by determining 
passwords assigned to Telemail subscribers through a process 
called "hacking". In this process, a "hacker" chooses a 
subscriber account such as Raytheon, NASA, USDA, RADA Corpora- 
tion, Coca Cola USA, 3M Corporation. The “hacker” then 
begins to try numerous successive passwords (e.g., each letter 
of the alphabet, or the administrator's first name, etc. } 
until the correct password is, discovered. Many hackers program 
their home computer to systematically try passwords for hours 
at a time. Once a hacker has broken a terminal's password, 
he can now enter the Telemail system as if he were the 
legitimate subscriber. He would do this by calling any 
published Telenet dial in number and then placing his telephone 
on his modem hookup. This modem hookup now allows him to 
type on his home computer keyboard and have the impuises sent 
through the telephone system into the Telenet computer 
system. He then types in the command "Mail” and enters the 
Telemail mailing system. At this point the computer prompts 
him with “User Name?". He then types in the words (for example) 
ADMIN/NASA. The computer then prompts with “Password?" 
and he then types in the password that he has discovered 


through hacking. At this point he is accepted by the system 


360 


@ 
as a legitimate subscriber, and may perform many of. the 
functions that the subscriber can perform, all of which would 
be charged to the legitimate subscriber. At this point the 
hackers create a pirate subdivision in the legitimate 
subscriber organization, such as ADMIN/inner circle/NASA 
and then set up user names in that new "pirate" account. 


User names may be any compilation of letters and numbers but 


are usually a first initial, period, then last name (i.e., 
b6 


Co). The hacker, as administrator of his own pie 


subdivision, now sets up passwords for all his users, notifies 
them of their user name and password and they can now enter 
Telemail with their names and passwords. These users may 

now leave messages on the system to an individual -in the 
group, to the pirate administrator or (because the computer 
believes they are legitimate) to any other user (legitimate or 


illegitimate) in the entire Telemail system. 


pert” 
Blel 


PROBABLE CAUSE 
1. On approximately August 23, 1983 GTE Telemail 
discovered an unauthorized user in the account of their 
customers, Raytheon Company and American Hospital Supply 
Company (AHSC). This person has been using the fictitious 
name Cana was accessing Telemail through dialin “a 
number 914/3299199, whicn is in the Scarsdale, New York 


area. 


be 
told Special Agent re | FBI, that a review of b7c 


messages im AHSC shows that( sda been using the 


account of AHSC since at least August 16, 1¢83 and has 
entered the Telemail system at least 55 times, the latest 
being detected on September 22, 1983 and September 23, 1963 
in the accounts of NASA and RADA Corporation, respectively. 
3. Special agentL______—sdinas received information from Med 
Cc 
a confidential source, who has provided reliable information 
in the past, said information being confirmed by Special 


agent[__fana which information has led to an arrest 


on one occasion. This source stated to Special Agent b6 
b7c 


— 
Cd] 
a 


Blo 


4. Investigation by the FBI indicates that the telephone 


b7C 
a person by the navel O™—~——OCCCSYS date of birth 
Lsdresides at that address. 


5. It is common for the "hacker" to have an additional 
phone line in the residence to be used for the computer 


modem. There is, in fact, an additional phone line (number 


Lp at this address. 
6. Lidia a message left on the Telemail 


signed the message with the name} 


7. On October 4, 1983 Special agentL______—sdieaalied 
the number[_—sdj and asked if L__|was there. The 


woman who answered the phone said that[____Jwas not in at 


bE 
BIC 


that time. 


8. Due to the continuing nature of the offense, that is, 
the devising of a scheme or artifice to defraud GTE, 
Raytheon and AHSC through the use of computers and computer 
related equipment over a telephone at a given location, your 


affiant believes that the fruits and instrumentalities of 


said crime will be found at{ bé 
b7C 


BoD 


9. Based on all of the above facts, your affiant submits 
that there is sufficient. probable cause to believe that this 


on going offense is located at the premises known asl__] beé 


the Southern District of New York, At that location are 
computers and computer related paraphernalia, records, 
documents, papers, and notes which are the fruits, evidence 
and instrumentalities of an offense against the United States. 
that is, wire fraud in violation of Title 18, United States 


Code, Section 15343. 


Special Agent 
Federai Bureau of Inves 


Sworn to before me and subscribed in my 
presence this day of October, 1983. 


UNITED STATES MAGISTRATE 


Abt 
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FEDERAL BUREAU OF INVESTIGATION 


L cate of transcriotion__2/10/84 


This is a summary of the activities of L_] 
on GTE Telemail. be 


CL Jused the name[_ ion Telemail. pic 


He was registered as an illegal user in AMERICAN 
HOSPITAL SUPPLY COMPANY ({AHSC)} and RAYTHEON COMPANY. 


In his messages,|_____—sdidiscussed among other bé 
things such projects as “the Ultimate Rip-off" in reference bic 
to the Telemail computer account of CITIBANK OF NEW YORK. 


is known to have accessed the Telemail bE 
system at least 36 times between August 14, 1983, and BIC 
August 24, 1983. 
Investigation on 2/6/84 at__Alexandria, Va. rie « Alexandria 196A-633 
. bé 
by SA gay Date dictated 2/6/84 BIC 
‘This document contains neitner recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date ut transeriotion 1/30/84 


a number ; was advised of pe 


the official identity of the interviewing agent and thereafter Plc 
provided the following information: 


[Jon che osuny bulletin 
E1083. While looking at messages 


vas able to see 2 private 


DAaLTY on that board. This message Be 
name and the message Ris 
fect that "you can call me atc 
:ALG ne Called the number once 
na number and a male answered. 
sav anything, ut simply hung 
b6 
b7c 
used the Telemail service 
joing so communicated b6 
first name or bic 
and 
| Far ner stated that he did not know 
therm nes were being Be 
Ak mehow this bie 
no2 20 a JOurcs ecunt or a 
ser a person wonld be billed through 
S35 Ou nave connected with those 
ter 
also provided the foilowing identifying 
information: 
bé 


Date of Birth: bIC 
Age: 


Social Security 


Account Number: Ld 


1/25/84 at Alexandria, Va. rnedlexandria 196A-633 


Investigation on 


wy —____ sa gai os 


This document contains neither recommenaations nor conclusions of the FAL, tt is the property of the FBI and Is joaned to your agency; 
it ang itt contents are not to be distrinuted outside your agency, 


be 
aictated 1/26/84 bic 


AX 196A-633 2 
Height: 
Weignt: be 
Eyes: pie 
Hair: 
ae 


30% 
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FEDERAL BUREAU OF INVESTIGATION 


PROSECUTIVE REPORT OF INVESTIGATION CONCERNING 


b6é 
b7c 


Copy to: 1 - USA, Alexandri be 
(Attn: AUSA ) BIC 


FSI/003 
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NAME OF DEFENDANTS: 


1. LC _—sé«ss described as: 


b6 
gt b7C 


313 
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2. [described as: 


Race _ QD - 
Sex— 6 Pe 
Date of Birth 

Address” 


- 214 
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Race 
Sex, 
pate of Birth 
jal. rity 


BIS 


be 
b7Cc 


AX 196A-633 


» (ees * 


_Race~ 

ace ye b6 

Date of..Birth ™ 
Address 


anv 


5. Lig described as: 


Race 

Sex 

Date of Birth 
Address 


an 


b6 
b7c 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 

2. the premises located at: 


On October 12, 1983, 


were searched 
pursuant to a duly authorized federal search warrant and 
various computer paraphenalia were seized. 


2 


b6 
BIC 
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WITNESSES: 
* Ld 
elemai 
8229 Boone Boulevard bE 


Vienna, Virginia bIC 
Pelephone |] 

Can provide details of GTE Telemail operations, 

methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


2. b6 
Special Agent bIC 
Federal Bureau of Investigation 


Can supply details of investigation. 


. 
Special Agent 


Pederal Bureau of Investigation b6 
Los Angeles bIC 


Can supply details concerning search off] 
. 
Special Agent 


Federal Bureau of Investigation b6 
Los Angeles b7c 


Can supely details concerning searches ind 


bé 
b7¢c 


through personal knowledge. 


374 
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EVIDENCE: 


1. List of four messages left bi on Telemail 
(original in possession of 
an GTE Telemail). 

2. Summary of relevant evidence seized in search 
2 —— lan possession of FBI Alexandria). 

3. Summary of information found on "floppy discs” 
seized in search (discs in possassion of FBI Alexandria). 


List of charges attributab. | arene 
(original in possession of GTE Telemail). 


1. List of 39 messages left on GTE Telemail by 


CL originals in possession offi 
2. Summary of relevant evidence seized in search 
ot DE Nin possession of FBI 


Alexandria). 


3. List of charges attributable to ka 
eee in possession o GTE 


Telemail). 


4. Summary of trap and trace information received 


1. List of 67 messages left b on GTE Telemail 
(originals in possession of GTE Telemail). 

2. Summary of relevant evidence seized in search 
at (in possession of 
FBI exandria). 


3. Summary of information found on "floppy discs” 
seized in search (discs in possession of FBI Alexandria). 


4. List of charges attributa akal 
Co leriginal in possession of fi 
f trap and trace information received 
from 
ar 2H 


be 
b7c 


b6 
b7c 


be 
b7¢c 


be 
bIC 


b6 
b7c 


b6 
b7C 


bIE 


bE 
b7C 


b6 
b7C 


b6 
b7c 


b7E 
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ee (0 of eight messages left on Telemail vyL_| 


{originals in possession of 


2. Summary of vv. vi e seized in search 
of (in possession of 
FBI Alexandria). 


3. Summary of information found on “floppy discs" 
seized in search (discs in possession of PBI Alexandria). 


4. List of charges pfs col ts—~—OY 


(original in possession of 


5. Summary of trap and trace information received 


b6 
BIC 


b6 


bIC 


be 


bic 


BIE 


FO-302 ine seqn 


FEDERAL SUREAU OF INVESTIGATION 


12/15/83 


Date of transcription 


The following is 2 of messages left_by the 
iiiegal user using the nanepo ena] 
on GTE Telemail. The date and time of each message 1s bic 
provided with a synopsis of particularly significant messages 
included. 


1) August 27, 1983, 11:47 p.m. (Eastern Standard Time) 

2) August 30, 1983, 4:04 a.m. {Eastern Daylight Time) 

3) September 3, 1983, 4:01 a.m. This message is from 
[____[#Fone/Ray thon to Admin. Message reads, bE 
Orgot my other PH I'll have b7C 


to check it out with 
4) September 10,1983, 9: p.m. 


investigation on___ 2/9/83 Alexandria, Virginia File » Alexandria 196A-633 
el b6 
SA t. 
by Date dictated 12/9/83 pic 
This document contains neither recommendations nor conclusions of the FB}. It is the property of the FEI and és loaned to your agency; 
it ang its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/20/84 


The following is a listing of evidence pertaining 
to the illegal intrusion into GTE Telemail found at the 


b6 
‘premises known as pyc 
This is the residence o 

1.) A computer print-out listing 38 syste 
users beginning with account number one belonging to b6 

and_inciudin b7C 

and others. 

2.) Numerous copies of a magazine newsletter 
called "Tap". These newsletters contain information on 
defeating alarm systems and numerous articles on how to 
avoid paying legitimate charges to the phone company. 

3.) A computer listing which lists the contents 
of a floppy disc. A sample of the contents listed are 
as follows: T 001 B. Telemail less than 9, T 005 B. Telemail 
less than 13, T 005 B. Telemail plus 4.1 less than 9, 

T 003 B. Telemail less than 13. 

4.) A 3" X 5" card with the following words 
hand-written on it:[ dad others. 

5.) A 3" X 5" card with the word Autonet, followed pie 
by C 21311. This card also contains umber 
800-424-9096, followed by the words Please". 

6.) A 3" X¥ 5" card which, on one side contains 
the name followed by the phone number 
(W) and (H). On the reverse of this card bé 
are the following words: Telemail (T@Mail): Username: pyc 
DCLNBB, password: Bill, followed by the words “use help". 

Also found on this side of the 3" X 5" card are the words 
followed by break system. 

7.) A 3" X 5" card which_contains the number 
Ls followed by the name On the be 
reverse of this card the word is found and the number b7C 

investigation on 1/17/84 at__ Alexandria, Va. rue ALexandria 196A-633 
oy SA ai Date sictates 1/17/84 bé 
BIC 
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8 A computer print-out which is signed by 
the user 


by the numbers 
this number 
is followed 


Y 
and also the number Also f£ is sheet 
of paper are the numbers and 
10.) A shee £8" X 10" white paper i 
bears the name[ and the phone number 
11.) A computer print=- itled MC jt 
Card Access Numbers and signed "alias" 


12.) A copy of the Uninet network access phone 
by state. 


This pape 
of paper is found the 
by the phone number 
ofl} aka 


14.) A copy of "revised tymnet phone numbers". 


so has the name 


this sheet 
followed 
s the home phone 


15.) A green sheet of paper from a spiral note 
book with handwritten words as follows: TRW, Arpanet, 
Milnet, TVETLINK-Telnet. 

16.) rint 


A computer ~out with three messages 


to 
message iS 
and the other two are 


i7.) A computer print-out_with a number of 
messages on it, one of which is from This message 


refers to The other _tw is computer 
print-out are and 


Bt 


be 
b7c 


be 
bIc 


b6 
b7C 


b6 
b7Cc 


b6é 
b7c 


b6 
b7c 
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18.) A computer print ith one message 
starting “Hil OF and ending 


19.) A copy of the Oklahoma Modem Users 


Newsletter, dated September 1, 


20. A 3" X 5" card 
name 


21. A white 3" xX 5* 
name but it is spelle 
the phone n er 
to a confidential source _b: 
source was told that 


C4 The customer name and 


Grow 
1983, and signed pL] 


which bears the handwritten 


i contains the 
d followed by 
This number was given 


and the confidential 


address for this number 


22.) A 3" X 5" card that has the name[__—itKk 
followed by the number 


23.) A 3" x 58 
[Jana the phone_number 
phone number for 


This 3° X 5" card also contains 


followed by the following numbers: 
a (C37) een (CP 


24. 


label from 


7, 1983. 


25.) The remnants of 
been torn into numerous pieces. 
the writing on the 3° xX 5" card 


ellow manilla envelope with a mailin 


mtains the initials 
This is the home 


the 


It is dated September 


a 3" X 5" card that had 
When placed back together 
reads as follows: The 


check is good. I swear _i Don't ry checking for fingerprints, 
I'm careful. Signed, 


Also seized in the search were items labelled 
paraphenalia, which appear to be homemade pipes and tubes 


for smoking marijuana. 


Also seized was a switchblade knife. 


38S 


bE 
bIC 


bE 
b7C 


b6 
b7C 


be 
bICc 
b7D 


be 
b7¢c 


b6 
b7c 


bé 
bic 


b6 
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FEDERAL BUREAU OF INVESTIGATION 


Cate of transcription 1/30/84 


On October 12, 1983, a du i 
warrant was executed at the address 
a the home of The oppy b6 
Iscs at were seized pursuant to the search warrant b7C 
were examined brDo of a computer programmer. 


Following is a summary of the information that Lebowitz 
found on these discs. 


On the disc labelled 196-633 Sub a 

Number One, is found a program calle TELENET, " 
This 1s a listing of various telenet host connect addresses. b6 
A program called "Numbers" contains a message bIC 


abou me numbers. is a nickname for 
and alias o The program called 
ay one" contains a message on how to misuse or abuse 


pay phones. 


On the disc labelled 196-633 Sub sf Fd 
Number 2 is a program called "Hack. Sprint. 

is is a program to find Sprint access codes. Three programs 
titled “Hack. MCI.", “Hack. ITT.", and “Hack. METRO.", b6 
were designed to hack out MCI, ITT, and Metrophone authorization b7C 
codes respectively. A program called "Hacker II" is designed 
to find access codes for many different long distance systems. 
A program called "Codes MCI" is a listing of MCI access 
codes actually found. A program called "CODES SPRINT" 
is a list of Sprint codes actually found. 


On the disc labelled 196-633 Sub G, 181,. _—idsi 
eel is found a program called "JOLOY I" This b6 
contains numerous messages from a bulletin board. These b7e 
messages include numerous passwords as well as numbers 
given to "Phreak on Telenet." A program called "JOLOY 
II" is a listing of connect addresses on different systems 


on telenet. One of the systems is listed as "Allied Corp 
Confidential." A program called "OSUNY" contains information 


Investigation on 1/13/84 at____Alexandria, Virginia riesAlexandria _ 
196A-633 
Sub& 


a ois citmea___1/13/84 im 
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from on MCI credit card access methods. 
It also contains information on a magazine called "Tap" 
devoted to phreaking on phones. 


The disc labelled 196-633 Sub G, isi, 
Number 4, contains a program called 
TITLES. This program is a listing of various messages 
from a bulletin board. The program called "B. INT CALLS 
W/BLUE BOX - 29" contains a message from the phantom concerning 
how to use a blue box device for free overseas phone calls. 
A program called "B. Telemail - 5" contains a message 
from concerning a new bulletin board 
that he has set up within the telenet system. The program 
calied "B. MITRE - 5" contains a message from 
giving passwords for the MITRE Corporation Computer 
on Arpanet. The program called L__jeoco4. MAIL" contains 
a message to from Jupiter - PBN. This program 
provides an identification name and password for a computer. 


alled "D. DANGER! - 3" contains a message from 
to all users warning of people being searched 
y authorities. The program called "B. TELENET?? ~ 9" 


contains a message from[ ee to everybody concerning 


Telenet. The program called * OT GTE - TELENET) 
- 18" contains a message from telling everyone 
to make sure to purge their messages. The program called 


"B. AUTONET - 26" contains a message from 
to all concerning a new network called "AUTONET." This 
message also asks for an Arpanet Access Code. 


The disc labelled 196-633 Sub G, 1Bl, 


Number 5, contains a program labelled 
"B. MASS. GEN, HOSPITAL - 14." This program contains a 


message from[ ion how to use telemail am 
called “B. ARPANET - 5” contains a message fron[ | 
on how to get into Arpanet from Telenet. The 

rogram called "AUTOVAN'ERS - 31" contains a message from 

Poses Stabout how to dial into the Autovan Network. 

The program called "B. SCC'S - 5" contains a message from 

Cabot phone numbers for a customer 
service of the "Lesser Known FCC's." The program called 

"B. ITT DIALCOM NETWORK ~ 5” contains information from 


on the ITT Dialcom Network at how 
to enter the network. The program called "B. WHO CARES" 


at 23 


bE 
b7C 


b6 
b7C 


b6 
bIC 
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contains a listing of telenet connect addresses from 
The program called "B. TRW - 19" contains 


a message from about a TRW Computer 

System he found. The_program called "B. TRAVEL-NET - 29" 

contains a note ron[ Jon how to find access 

codes to Travelnet. The program called "B. WRONG!!I!!!! b6 
- 29" contains a message from about how to bIC 
use a “phone trunk." A program calle B. NOTES ON SKYLINE 


- 5" contains a message from about 


finding codes for Skyline. I rogram called *"B. CODACAS 
~ 1" contains a message fromp about how 


to play a “On-line” computer game- 


The disc labelled 196-633 Sub G, 1B1, b6 
Number 6, contains a message Labelle b7Cc 
"PHREAK 932" which contains numerous messages from a home 
bulletin board. 


The disc labelled 196~433 Sub G, 1Bl, 
Number 8, contains a program called b6 
"OLD DATAPAC." This program contains a message from[___| b7C 
about a Canadian electronic system called 
Lv. & . 


ar 39d 
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FEDERAL BUREAU OF INVESTIGATION 


Oate of transeription__ 1/31/84 


L$ GTE-Telemail, provided a Copy of the amount of money 
ro) 


st bY GTE Telemail from the unauthorized use by the hackers. pie 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
in ating totals by each user, combining multiple user names 
(this summary covers the months of July, Auqust and September 
for each company): 


USER COMPANY AMOUNT MONTHS 


| AHSC $62.29 July, Augusr, 


September 


UAW . $31.00 September 
be 
CL] Maraven $16.00 August, September bie 
Telenet $108.00 July, August 
| BMW $0,29 September 
$127.58 


| CBOT $2.00 September be 


b7C 
Ch RADA $1.00 September 
$3.00 
| Maraven $24.00 August 
Telenet $325.00 July b6 
b7c 
Telenet $151.00 August 
. 
so Ld 
Investigation on 1/25/84 a _Alexandria, Virginia ries Alexandria 196A-633 
by SA a bate aictarea__ 1/25/84 b6 
bIC 
‘This document contains neither recammendations nor conclusians of the FBE. It Is the praperty of the FBI and is loaned te your agency; 
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@ Dv everotin —_22/29783 
The following is a_su es left by the b6 
illegal user using the name[ fon GTE Telemail. BIC 


The date and time of each message is provided, 
with a synopsis of particularly significant messages included. 


1) September 14, 1983, 9:56 o.m. (all times Eastern 
Daylight Time) 
2) September 14, 1983, 
3) September 14, 1923, 
4) September 15, 1993, 
in part, "TI nave 
some neat info." 


This messaze reads 
around 


2,500 n 
computer 


poy? 


Investigation on 


Date ontated 


This document contains neither recommendations nar conciusians of the FBI. It is tne property of the FBI and 15 toaned to your agency. 


it ana its contents are not Lo pe distributed autsige your agency 


ers aq 


a Lun uso 


"The an@enise: e Page __2 


Continuation of interview of 


12} 
13) 
14) 
15) 
16) 
17) 


18) 


Nite be 


WIIKEY HOS 


WYN 


‘in part, “Well, you have finalls 


September 21, 1983, 12:05 a.m. 
September 21, 1963, 12:07 a 
September 21, 1983, 12:19 a.m. 

September 21, 1983, 1:40 a.m. 

September 22, 1983, 2:28 a.n. 

September 22, 1983, 2:30 a.m. This messaac reads, 
“Read this ane then loc back in anc read a MSG 
that I left for too: Admin/Promo. Also, 

say hi for me." Siqned 


be 


September 83, 10:53 p.m. This message reads, pre 


, 
"Think about it, cuz momma wants me to play with 
her credit. (Or at least check it)" 

Sentember 22, 1903, 2C a.m. 

September 22, 1983, 

September 24, 19€3, 

September 24, 1953, 


Sertember 24, 1983, 9:4 

September 25, 1962, 2:2 

September 25, 1963, 1:0 

September 25, 1923, 2:33 

Sevtember 25, 1983, 1:06 

September 26, 19£3, 1:06 

September 26, 1963, 10:29 n.m. This message re 

I Gecided that the SCPr 


"That is okay. Cuz 
was enough I will just try to hack out somei: 
else's P (I downloadec the hel¢ user lis 
the whole Admin. Gece, wouldn't it be 
if I hackec the z Aamin/teLemaii!!?? 
September 27 2 
September 27 
September 22, 


nace it to the most 
elite BBS there is. Teiemail. bo not mention names 
or anythine clse on here, Just in case the FET wante 
to make an example of the aqrour. (SCPF)” 

September 2€, 193, 3 
September 29, 19€3, 
September 29, 1983 
October 1, 1983, 1 
Octoher 2, 1993, 2: 


Bas 
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"The Anarchist” 


Page 2. 


continuation af interview of 


This message reads, 
is no BIC 


39) October 7, 1983, 9:52 p.m. 
"Well, as far as I know, 
longer a member of the SCPP. 
should delete him." Signed 


2A 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcrtotion__12/1/83 


The following is a summary of a review of the 
evidence seized in a duly_authorized search warrant conducted 
at the residence known as 
This is the home address of 


be 
b7¢c 


The following is a summary of evidence that is 
relevant to this case. All evidence from print-outs, etc., 
were obtained from a single black three ring binder. The 
following items were contained within that binder: 


(1) A computer print-out with approximately 
30 metro phone access codes. 


(2) A lined sheet of paper with 32 names 
and numbers written on it. Of particular 
interest is number 03 which reflects the 


name followed by the phone 

number ana |S Number 04 

is followed by th bé 
number Both[ and 


were illegitimate users of the Telemail pie 
System and the node known as SCPP. This 

sheet of paper also contains the names 

with telephone 

It also contains the 

and the phone number 

These previous people were also 

the subject of searches conducted by the 

FBI on October 12, 1983. 


(3) A computer print-out listing approximately 
20 MCI access codes. 


(4) A list of Telemail commands. 


{5) An unlin £ paper bearing 
Underneath that b6 


the telephone number b7C 


is the name 


investigation on_L1/15/83 sal exandria, Virginia rie « Alexandria ___ 
196A-633 


o_sal pw one aciiea__-11/15/83 bs 
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(6) 


(7) 


(8) 


(9) 


(10) 


2 


A computer print-out with a list titled, 
"Users SCPP."_ That list then lists the names 


be 
b7C 
A computer print-out labeled Telenet Admins. 
This is approximately 20 pages that apparently 
lists every Telemail administrator. 
A computer print-out that has the_w be 
Arpnet and the telephone number 7 
written on it. This is followe y wha bic 
appeared to be commands to access a host. 
A multiple page computer print-out that 
begins La —_]Presents es the be 
Complete Telenet Access Port Directory." bIC 


This is followed by an extensive listing 
of what appeared to be very Telenet access 
dial in number. 


A computer print-out with additional 
handwritten notes on it. The notes began 
"558" and then the word prefix followed 

by approximately 50 four digit numbers. 

Some of these four digit numbers have the 
word Telenet written next to them. This 
computer print-out also contains the word 
nodes followed by the term Raytheon Promo- 
Promo and then the word "Bang" then the word 
SCPP. This print-out also contains the 
handwritten word nodes TRW. Both Raytheon 
and TRW were Telemail host companies that were 
illegally penetrated by Hackers. 


we AY 
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FEDERAL BUREAU OF INVESTIGATION 


iL 1/16/84 


Date of transcription. 


A review of the “flo disk" seized duri: 
a search of the residence a be 
revealed that there was nothing on b7c 


the oppy disk that pertained to Telemail or any other 
illegal activities. 


1/10/84 Alexandria, Va. Alexandria 196A-633 
Lavestigation on at ~ Fite #— 
bé 
sal fas 1/1/84 bre 
by Oate aictatea 
This document contains neither recommengations nor conclusions of the FBI. it is the property of the FBI ana is loaned to your agency: 


it and its contents are not to pe distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription__L/ 31/84 


On January 24, 1984, 

GTE-Telemail, provided a copy of the amount of money 
lost by GTE Telemail from the unauthorized use by the hackers. 
This document is broken down by user and by company. 


b6 
b7c 


Many of the hackers had two or more user na 
therefore the following will be a summa 
indicating totals by each user 
(this s 
for eac 


mes, 

y of the above docu 
' mbining multiple user names 
ry covers the months of July, August and September 
company): 


USER COMPA 


MONTHS 


b6 


b7c 
Cc RADA 51.90 September 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July bé 
Telenet $151.00 August pic 
sve 6L__] 
Investigation on 1/25/84 a Alexandria, Virginia ries Alexandria 196A-633 
oe SA sfk vate aictatea___L/25/84 BG 


b7c 


This document contains neither recommengatians nor conclusians of the FBI. It 1s ine property of the FBI ang is loaned ta your agency; 
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FO-302 (REV. 3-8-77, 


FEDERAL BUREAU OF INVESTIGATION 


Date of transeription_12/19 /53 


The following is_a_summa of messeges left by bE 
the illegal user known as[o on GTF Telemail. b7C 
The date and time of each message is provided 
with a synopsis of particularly significant messages included. 


1) September 13, 1983, 9:51 p.m. (All times Eastern 
Daylight Time) 

September 14, 1923, 1:18 a.r. 

September 14, 063, 1:27 a.m. 

September 14, 1963, 12:23 a.m. 

September 15, 1963, 1:48 a.m. This messeqe re 
in part, "Well, T have only reac a fow msqs that 
were not a@dresse@ to the SCPF. Most of the time 
I get the 'infe. withheld for privacy’ crap. I'm 
gonna keep trying though." 

G) September 14, 1983, 6:25 p.m. This message reads, 
“Well, what do you think? Remember that there mey 
always be someone up there watching, so be careful 
what you sey. Try to access all _the neato things 
you can, okay? I'll talk to when I car. 

7) September 14, 1933, 10:41 p.m. This message reads, 
"Watch what you say on here. Bic Brother right be 
watchine. Like, don't use people's first names 
and stuff. Neat system, huh 

8) .September 15, 1963, 1:55 a.m. This messace reads, 
"Well, we now obviously have a creat incentive 
for Tobue new members. (Guess) I already told bb 


Woe Wt 


but we neec to start coing for recruitment bIc 
ast before this thina gces out. [jane Ll were 
even talking about setting up a private SCPP Board 
in someone's house after awhile." 
9) September 16, 1983, 2:15 a.m. 
10) September 16, 1983, 7:37 p.m. This messace reads, 
“I'd like to talk to you about a few things. Is 


it all richt if I call you? I ha your Ph#, mine 
ish sd and my name is if you b6 


wanna call me.” bic 
11) September 17, 1983, 2:14 a.m. 
12) September 17, 1933, 3:10 a.n. 


investigation on__ 22/13/83 Alexandria, Virginia cues _PLexandria 196A-63 
. Sub G 
by SA bel loate aictatea 12/13/83 Ps 
BIC 


This document contains neitner recommendations nor conclusions of the FGI. It is the praverty of the FBI and is ‘caned to your agency; 
it ana its contents are not to be distributed outside your agency. 
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AX 196A-633 Sub G 


conmmuaten ot ntoriewor___[ 


. Page pic 


13} September 17, 1983, 2:25 p.m. 

14) September 17, 1983, 4:36 p.m. 

15) September 15, 1983, 9:06 p.m. 

16) September 15, 1983, 9:11 p.m. 

17) September 16, 1983, 2:15 a.m. 

18) September 16, 1983, 12:51 a.m. 

19) September 16, 1983, 12:55 a.m. 

20) September 17, 1983, 5:48 p.m. 

21) September 17, 1983, 5:54 p.m. This message reads, 
“Don't worry, I don't think there is anything to 
worry about BFCA; system interrupt mode;;; I know 
who you are. You should know better! Telemail 
deleting user: SYS 3471874/CUT ielemail disconnected 
at 13:35 49 49 47 4c." 

22) September 17, 1983, 5:56 p.m. This message reads, 
"Did you know that if you do a shift control P 
anywhere that it will put you into Telenet and still 
be connected to Telemail? Then you do a CONT at the 
Prompt... later." 

23) September 17, 1983, 6:02 p.m. 

24) September 17, 1983, 6:37 p.m. . 

25) September 18, 1983, 6:18 p.m. This message reads, 

3 some for VAX on Telenet." This 
message is asking for connect addresses for a 
particular type of computer system (VAX) on Telenet. 

26) Sentember 18, 1983, 11:06 p.m. This messace reads, 
"No I don't have a nev method of hackine VAX LAMO, 
it is called someone gave me some passwerds, Jesus 
Christ, why couldn't you have just given ther to me 
without having to ask such a lame question?" 

27) September 20, 1983, 2:10 a.m 

28) September 20, 1983, 10:20 p.m. 

29) September 21, 1983, 1:01 a.m. 

30) September 21, 1983, 1:05 a.m. 

31) September 21, 19983, 6:22 p.m. 

32) September 21, 1983, 11:13 p.m. 

33) September 22, 1983, 1:48 a.m. 

34) September 21, 1983, 6:32 

35) September 21, 1963, 9:22 

36) September 21, 19&3, 7:21 

37) September 22, 1983, 6:00 

38) September 22, 1963, 8:05 

39) September 23, 1983, 12:5 

40) September 23, 1983, 1:07 

41) September 22, 1963, 9:29 

eer 


AX 196A-633 Sub G 


| _ 2 ve 
Continuation of interview of . Page 


42) 


September 22, 1983, 10:16 p.m. This message is bé 

co:[ Jane reads, “Can you please tell me bic 
how to make free calls?" 

September 23, 1983, 12:58 a.m. 

September 23, 1983, 1:02 a.m. 

September 23, 1983, 1:02 a.m. 

September 24, 1983, 12:23 p.m. 

September 23, 1983, 1:07 a.m. 

September 23, 1983, 6:09 p.m. 

September 24, 1963, 1:10 a.m. 

September 24, 1933, 2:31 a.m. 

September 24, 1983, 11:57 a.m. 

September 25, 1963, 12:39 a.m. 

September 25, 1983, 2:02 a.m. 

September 25, 1983, 11:25 a.m. 

September 25, 1903, 6:20 a.m. 

September 25, 1983, 12:44 a.m. 

September 26, 1983, 1:00 a.m. 

September 26, 1983, 11:54 p.m. This message reads 


in part, “The majo hers are probarly becinning 
to notice det arting to 
make a nane for themselves an is Scares them, 

so th trv to do anvthina they can to disrupt this." 
hs a seit reference. 


Sentemker 27, 1963, 10:40 a.m. bs 
Septerber 27, 1983, 12:32 a.n. pyc 


Sertember 28, 1953, 1:34 a.m. 


_ September 26, 1963, 9:41 mem. 


September 29, 1963, 1:30 a.m. 
September 29, 1963, 6:12 p.m. 
September 30, 1943, 9:34 p.m. 
October 1, 1983, 10:25 a.m. 
October 4, 1983, €:29 p.m, 
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FEDERAL BUREAU OF INVESTIGATION 


11/28/83 


Date of transcription, 


The following is a report of a review of evidence 
seized pursuant to a duly authorized Fe e Wa: t bé 


onducted at the residence known as pyc 
— This 1s the residence o aka 


The following is a summary of the evidence contained 
on hand-written sheets of paper and computer print-outs: 


A eomputer print-out beginning with the words 
containing a sign-off as follows,[ | - 
bic 


2.) Two sheets of paper with the vords,[___| 


Ls |printea out on it. 


3.) A two-page computer print-out titleaL___| 
Telenet Addreses. This contains numerous connect be 
addresses and names of various telenet hosts including Citibank 7¢ 
Cash Manager, Nasa Reconnaisance and E.F. Hutton. 


4.) A computer print-out i 
Access Codes. This consists of numerous connect addresses be 
and names of host systems, including Nasa Reconnaisance, bre 


Stanford university, Dartmouth College and Irving Trust Cash 
Register. 


numerous names and phone |. 
BUSES teeduding telephone number Bre 


This 1s a computer print-out of a message from 
jaten 9/17/83, listing a source account and 
password and three other computer accounts and passwords. b6 


pyc 
computer print-out containing a message lef 


dated Jul no_ year M xe 
SS and -SECSSS numbers . Cs 


the subject of a search in 


investigation on___2 2/17/83 _y Alexandria, Virginia ,,, Alexandria 19€A-633 
Sub G 
| oats outaea____11/17/83 bs 
. b7c 


This decument contains neither recommendations nor conclusions of the FGI, it is the property of the F&I and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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AX 196A-633 Sub G 2 


8.) A computer print-out with a messag 
[___|aated 9/9/83, stating in part, "My number: " 
Underneath the number is hand-written the word 


9.) A sheet of white paper with an 
written on it rophoued = the word Carrier ~ and then 


the word Voice - 


10.) A sheet of white 
“Reali Names: 


aper with the 


ote on it 


11.) This is a computer = £ 
win mi nd 2. i i 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 
Oate of transeription, 

During the months of November and December, bé 
a a computer programmer, examined prc 
various software an floppy disks” in connection with 
this case. 

found the following information that oe 
is of interest: cies 


On the "floppy disk" labelled 196-633-Sub G 
1B2, Number 7, the words "Osuny BBS ‘text'" is found. When 
this floppy disk was placed in the computer it revealed 
the following information: Under the title "“Pile2’, b6 
found various and assorted messages from a home "bulletin bie 
board". These messages includea listing of various credit 
card long distance access numbers and instructions on 
how to break into a computer system known as RSTS. 


In a section labelled "NSG3", found b6 
assorted messages from a bulletin board. found p7c 
additional messages from a home bulletin board in sections 


labelled "MSG5" and "MSG6". 


ai} 


1/10/84 Alexandria, Va. Alexandria 196A-633 


Investigation on at File 2 _ 


be 
ss anes a 
: 


= Date dictated 


“a 
This document contains neither cecommendations nor conclusions of the FBI. It is the property of the FBI arid is loaned to your agency; 
it and its contents are not to be distributed outside your agency, 
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FEOERAL BUREAU OF INVESTIGATION 


ES Date of transeriotion, 1/16/84 
ized in the search of 
the residence of 
one duo fone dialer. This is a hand~held bé 
evice which simulates the tenes produced by a touch tone b7C 
phone. This type of device is often used by hackers and 
phone phreaks to by-pass billing procedures used by the 
phone company and obtain free long distance phone calls. 
1/10/84 Alexandria, Va. Alexandria 1964-633 
lavestigation on. at File 
b6 
by ga3 ome victatoa_2/11/84 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FA and is loaned to your agency: 
it and its contents are not to be distributed outside your agency. 
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‘e e 
FEDERAL BUREAU OF INVESTIGATION 


Data of transcription. 1/31/84 


On January 24, 1984, 


GTE-Telemail, provided a copy of the amount of money re 
Tost by GTE Telemail from the unauthorized use by the hackers. c 
This document is broken down by user and by company. 
Many of the hackers had two or more user names, 
therefora the llowina will be a summary of the above document, 
indicating totais by cach user, combining multiple user names 
(this summary months of July, August and September 
for eacn con 
CSER _ AMOUNT MONTHS 
Ss 
£31.00 September 
b6 


Slo6.00 August, September b7c¢ 


$108.00 July, August 


$0,29 September 
$127.58 


| csor $2.00 September b6 
b7C 
| RADA $1.00 September 


$3.00 
| Maraven $24.00 August 
Telenet $325.00 July b6 
b7c 
Telenet $151.00 August 
ss 6d 
Investigation on 1/25/84 a_Alexandria, Virginia rues Alexandria 196A-633 


a ee! sik pris dewea_ 1/25/84 Pé 


b7¢c 
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FO-302 (REV eb : 


Date of tramscription__L2/19/83 


The followin . of messages left by the bé 
illegal user known | GTZ Telemail. The bee 
date and tima of each message is provided with a synopsis of 


particularly significant messages included. 


1} September 17, 1983, 7:24 p.m. 

2) September 24, 1983, 1:07 a.m. 

3) September 24, 1983, 2:58 a.m. 

4) September 24, 1983, 2:54 a.m. 

5) September 27, 1983, 9:21 p.m. This message reads 
in part, "We decided that the party will start 
at 11:00 and this is for the SCPP Members who 
want to join. Then around 12:30 we will start 
the distribution of the newest stuff! We will 
have about five or six computers. One will be 
displaying Telemail for the new SCPP Members, 
one will be used for Prom-Blasting." 

6) September 28, 1983, 1:07 p.m, 

7) October 9, 1983, 2:21 p.m. 

&) October 9, 1983, 2:22 p.m. 


investigation of 2/ 13/83 a Alexandria, Virginia rie e Alexandria 196A-633 

b6 
oy SA bth bate atctatea__ 12/13/83 bre 
This document contains neither recammendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency: 
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FEDERAL BUREAU OF INVESTIGATION 


2 12/9/83 


Date of transcription 


This report is a review of evidence seized pursuant 
to a duly authorized Federal Search Warrant executed at 
the residence known as 


on October 12, 1983. This 
rs 


The following is a summary of hand-written notes 
or printed information of relevance to this investigation: 


bé 
b7c 


1.) A white sheet of paper containing a hand-written 
note beginning with the words "Hi boys" and ending with 
the signature “Love Dad“. A quote from that letter is 
as follows, "You told me about your ability to access other 
computers with the phone and right after you left those 
computer raiding stories developed. Some of those kids 
could get into a lot of trouble. I hope you two are using 
good judgement and not doing that type of thing. Think! 
I know you will." 


2.) A yellow scrap of paper with the woras[ | 
L____Jprintea on it. b6é 


b7C 
3.) A yellow sheet of paper with the words[__| 


[printed on it. 


4.) A computer print-out containing instructions 
about how to use a Telemail account. 


5 A_ computer print-out containing a message bs 
from dated September 17, 1983, in which he bre 
gives a source account, user name and password. 

6.) Two sheets of lined paper with hand-written 


notes listing names and_phone numbers. The names and numbers 
include the followin 


bé 

bic 
investigation on _EE/17/83 a__Alexandria, Va. rie Alexandria 196A-633 
_ oa baad one aces 11/17/83 __P6. 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 


Oate of transcription. 


Review of evidence seized in the search_of 
the residence of b6 


a brown manilla envelope with b7c 
3 a a _ {tee as 


' 1/10/84 : Alexandria, Va. en Alexandria 196A-633 
avestigation on al ile = 
b6 
SA gaj 1/11/84 bIc 


by__ Date dictated 


This document contains neitner recammenaations nar conclusions of the FAL. It is the property af the FAI and is loaned to your agency: 
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FEOERAL BUREAU OF INVESTIGATION 


Ll ate of transcristion_}/30/84 
Subsequent to a search pursuant to a duly authorized 
Federal Search Warrant at the residence known as bé 
the residence of pic 
a computer programmer, examined 
the Ooppy discs" that were seized in this search. 


following is a summary of the information 
that found_on those discs. On the disc labelled be 
196-633-Sub G 1B-3, Number Two, a program called pyc 
"MCI Place. MW" was found. This program contains an 800 
phone number and a list of MCI access codes. Another program 
on that disc was called "Passwords, MW." This program 
contains phone numbers of bulletin boards as well as individuals. 
It also contains MCI, Metrofone, and ITT access codes. The 
next program on this disc was called "Names." This contained 
a listing of administrators for the GTE telemail network. 


investigation on 1/13/84 a Alexandria, Virginia rue Alexandria 
1962-633 
SubG 
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FEDERAL BUREAU OF INVESTIGATION 


Oate of tranteription__ 1/31/84 


ee GTE-Telemail, provided a Copy o ne amount of money bic 
ost by GTE Telemail from the unauthorized use by t hackers. 
This document is broken down by user and by company. 
Many of the hackers had two or more user names, 
therefore the fellowing ll be a summery of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 
USER COMPANY AMOUNT MONTHS 
| HSC $62.29 
£31.0G September 
bE 
| Maraven $16.00 August, September pao 
$108.00 July, August 
| BMW $0,29 September 
$127.58 
| CBOT $2.00 September bé 
: bIC 
L.siédgd RADA $1.00 September 
$3.00 
| Maraven $24.00 August 
Telenet $325.00 July b6 
b7c 
Telenet $151.00 August 


1/25/84 Alexandria, Virginia 


at 


see Ld] 


cite» Alexandria 196A-633 


Investigation on. 


a eee oT 


Date dictated 


1/25/84 bé 


bIC 
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FEDERAL 8UREAU OF INVESTIGATION 


i 2/13/84 


Gate of transcription 


This is a summary of the activities cd a | be 


on GTE Telemail. bIc 


was an unauthorized user in the accounts of RADA CORPORATION, 


BTC 
ARSC, and RAYTHEON COMPANY. 
He accessed the Telemail System at least 18 times 
from approximately August 27, 1983 to September 10, 1983. 
true name and home phone number were provided be 
to the PBI by confidential source. bic 


investigation on__L/31/84 _a Alexandria, Virginia rile s_ Alexandria 
196A-633 Sub G 


be 
ov — sal dpa one acites__2/2/84 bre 


This document contains neitner recommendations ner conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


This is a summary of the activity of[  ———~sdY'SC(<;:tiéi 
on GTE Telemail. 


7c 

[__Jusea the nane| eo he was part of b6 

a group known as SCPP and was an unauthorized user in the pyc 
account of RAYTHEON COMPANY. 

accessed the Telemail System at least bE 

39 times between September 14 and October 7, 1983. BIC 

ided_b’ DIE 

6 

7c 


1/31/84 Alexandria, Virginia Alexandria 
at Fite. # 49-62-633—Gub—-G- 


bé 
ee 2/2/34 
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tavestigation on, 
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FEDERAL BUREAU OF INVESTIGATION 


a Date of transcription__2/13/84 


The following is a summary of the activity of be 


Co Jon GTE Telemail. b7c 


used the name[ sand was part 


ef a group known as SCPP, which was an unauthorized “node” Po 
in the account of RAYTHEON COMPANY. 
accessed the Telemail System at least bb 


67 times from approximately September 13, 1983, to October 4, 1983. b7c 


In a messa s. ember 16, 1983, he_states, bé 
“My phone number is and my name isL__ |" pre 


Tt d_ trace record bIE 
be 
b7¢c 

investigation on___ 1/31/84 at Alexandria, Virginia fie «_ Alexandria 


196A-633 Sub G- 


bE 
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.~ FEDERAL BUREAU OF invesTicaTiogy 


L Date of transcription 2/1 3 / 
This is a summary of the activity off) 


on GTE Telemail. 


Cus the name[ | 
nd were unauthorized users in the account of RAYTHEON 
bé 


COMPANY. 
accessed the Telemail System at b7c 
1983 to October 10, 1983. 


Bre 


least 44 times from September 15, 


and trace information 


S 
i 
3 
~ 
~ 
: . $ 7.7 _ ‘, 
Investigation on 1/31/84 a» Alexandria, Virginia ‘hie g Alexandri 
“—TICA=6535— 
. bé 
b7e 
Yeument contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency. 
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AXOG2E B46 16572 ; RECEIVE, B 


RR HQ AL BU DE La NY OC OM 


TO DIRECTOR ROUTINE 


ALBANY ROUTINE 
BUFFALO ROUTINE 
DETROIT ROUTINE 


LOS ANSELES ROUTINE 


NEW YORK! (BQ-MRA, HAUPPAUGE RA) ROUT HME 
OKLAHOMA CITY ROUTINE 
OmbHA ROUTINE 

PHOENIX ROUTINE 

SAN DIEGO ROUTINE 

aT 

UNCLAS 


4a NER as 


-FBW 3 CONSPIRACY; OG: AX 
REFERENCE ALEXANDRIA TELETYPE TO ByYREAU AND ALL RECEIVING 
rr $s 2 . . 
OFFICES, JANUARY 25 1984s 196-47 L/ 
FOR INFORMATION,“ON FEBRUARY 3, 1984, USA, ‘EDVA, SENT CETTERS . 
: 3 FEB 16 1904 


os . @® e® 


AGE TRIO 1964-643 UNCLAS 
TO ALL SUBJECTS OF SEARCHES IN THES MATTER. THIS LETTER INDICATED 
THE REVIEW OF EVIDENCE WAS COMPLETE ANO THAT MOST OF THE HARDWARE 
AND SOFTWARE WAS READY TO BE RETURNED, “THE LETTER CONTINUED 
THAT & PROSECUTIVE DECISION WAS STILL PENDIAG ANG THAT RETURN 
OF EVIDENCE SHOULD NOT BE CONSTRUED aS A DECLINATION OF CHARGES, 
FURTHER, IF NO RESPONSE WAS RECEIVED BY THE USA, EDVA, WITHIN 
TEN DAYS, THE MATERIAL WAS TO BE MAILED DIRECTLY TO THE OWNER. 

ACCORDINGLY, ALEXANDRIA WILL BEGIN MAILING MATERIAL NOT 
CONSIDERED NECESSARY BY THE USA, EDVA, DIRECTLY TO THE OWNERS. 

REFERENCED LETTER CONTAINED AN ITEMIZED LIST OF EQulPMENT 
BEING RETURNED AND INSTRUCTED OWNERS TO CONTACT ausaL___| 
[___]} cova, WITH ANY QUESTIONS REGARDING THE EVIDENCE. 
LEADS FOR ALL RECEIVING OFFICES: 

ANY EQUIPMENT IN POSSESSION OF AUXILIARY OFFICES MAY NOW 
BE RETURNED TO THE OWNER BY MAIL OR OTHER METHOD IF CONVENIENT 
TO THE AUXILIARY OFFICE. 

IT SHOULD BE NOTED THAT THE "HOLD HARMLESS” AGREEMENT 
MENTIONED IN REFERENCED TELETYPE 1S NOT NECESSARY AND SHOULD 
NOT BE EXECUTED. 
ANY QUESTIONS IN REFERENCE TO EVIDENCE SHOULD SE REFERRED 


b6 
b7c 


P&GE THREE 1964-633 UNCLAS 


b6 
To ausaL~=*&dSCEOWA,, TELEPHONE’ NUMBER. (783) 559-9109, bic 


BT 


® ? 


SAC, Alexandria 2/15/84 


Aa 
VW i Director, FBI 


FRA’ EE; CONSPIRACY 
00; ALEXANDRIA 
AX File Number: 196-A-633 


bé 
BIC 
UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND 
ELECTRONICS (GTE); TELENET SYSTEM CUSTOMER 
COMPUTERS; FRAUD BY WIRE; ITSP 
OO: MILWAUKEE em 
MI File Number: 196-B~798 
Bufile: 196-4578 
Sie hh BUDED: 3/1/84 
ReBulets to SAC, Alexandria, yet. Ypftores 0/27/83 
and 1/12/84, captioned as above. | 
ReBulet 10/27/83 contained an Oyrgirfdl request for the Q 
recipients to furnish information regarding computer hackers. As 
of 1/12/84, only four recipients of that communication had K 
responded, making it necessary to prepare reBulet 1/12/84 as a 
follow-up request. Responses from recipients of instant letter 
have not yet been received at FBIHQ. Submit your responses by NN 
close of business 3/1/84 to the Technical Services Division, Room 
7159. 1 - 
2 - Boston NY 
2 - Detroit ‘ WS 
2 - Newark NO 
2 - New York y 
2 - Omaha —_ Fy 
Exec AD Adm. _] = + 3841, TL #231 b6 a 
Exec AD inv. a 1376, TL #153 b7c fon 
Exec AD LES —__ < , 
Aast. Dir: SM a x 
es teeta 8 
Idget ——___-_. = ey 
np. 57] bg ga 
et B4M F&B 29 1984 Sy 
Lab. i8 o » & 
ieieas, fA 4 see 3 
Off. Cong. & dé by 
( Pho \ S 
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TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
Teletype Immediate OT j 
Facsimile O Priority 0 
K) Airtel O Routine . a a 
O UNCLASEFTO 
UO UNCLAS 
Date __1/19/384 | 


TO: DIRECTOR, FBI 
a {Attn: Technical Services,Division,; Room 7159) 
_ FROM:.SAC, LOS ANGELES (196A-3225) (WCC-1) (P) : be 
ron “Dp bic 
RE: MAIN FRAME; 
\ PBI; -CONSPTRACY 
\N 00: Alexandria 


Re Bureau letter to SAC Alexandria and Los Angeles 
dated 10/27/83 and Bureau letter from Director to SAC 
Alexandria and Los Angeles dated 1/12/84. 


For ,the. information of Technical Services’ Division, 
prior to receiving Bureau letter dated October 27, 1983, (3) 
Los Angeles Division had already packaged and forwarded 
to Alexandria Division all evidence seized in the searches 
conducted by Los Angeles. Alexandria Division is still 
in custody of this evidence and any review of the materiay ia 
seized would have to be accomplished by Alexandria Divisi 


DRH/BAR ‘ ~~ “a? a? JAN 28 1984 
(7) 


Approved: Br(Os, ___ Transmitted Per 
(Number) {Time) 


crore ema ceed 


Memorandum ® 
To : DIRECTOR, FBI Date 1/30/84 
(ATTN: TECHNICAL SKRVICES DIVISION, ROOM 7159) 
6, 
From DEG. BALTIMORE (196B-1048) (SQ. 7) (RUC) bs 
b7c 


00: ALEXANDRIA 


. ow 
Subject : MAIN FRAME 
) \ FRAUD-BY WIRE; CONSPIRACY 


= 


VY AX File Number: 196A-633 
™ 
b6é { 
bye 9 
UNAUTHORIZED ENTRY TO GENERAL TELEPHONE AND ~ a 
ELECTRONICS (GTE); TELENET SYSTEM CUSTOMER Q 
COMPUTERS; FRAUD BY WIRE; ITSP ~ 
00; . MILWAUKEE : 8 
. ae 


MI File Number: 196B-798 
Bufile: 196-4578 ‘ 


Re Bureau letters to SAC Alexandria, et al dated 
10/27/83 and 1/12/84. 


Recipients of the referenced communication fs) 
10/27/83 were requested to furnish information regarding) 
any possible link between the evidence seized in the jHackerns 
Matter and the Department of Defense computer systems), ay 
Baltimore Division neither seized any evidence in the\Hackers 
matter nor was advised of any such evidence seized by other 
divisions. Therefore, Baltimore Division can provide no 
opinion as to any possible link between the evidence seized 
and the Department of Defense computer systems. 


UNRECORDED COPY 
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y - Bureau 
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MDL:ds 
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Xb, 
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Memorandum 


To : DIRECTOR, FBI 


Date 1/19/84 
ATTN: TECHNICAL SERVICES DIVISION, ROOM 7159 


From: @ sac, OKLAHOMA CITY (196A-1270) (P} 


@) 


subject: “MAIN FRAME 
. PBW;—CONSPIRACY 
AX file number 196A-633 


UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE 
AND ELECTRONICS (GTE); TELENET SYSTEM 


CUSTOMER COMPUTERS; 

FEW; ITSP 

oO: Milwaukee 

MI FILE NUMBER (196-798) 
Bufile: 196-4578 


b7c 


Ré Bureau letters to Alexandria 10/27/83 and 1/12/84. 


-Oklahoma City Division has reviewed the enclosures of 


the Bureau letter of 10/27/83. 


Oklahoma City Division sees no significance in the 


enclosures, but it should be noted that all the data and 


information seized was forwarded to the Alexandria Division. 


Therefore, Oklahoma City Division does not have an extend 
of information by which to review the enclosures. 
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i ory 


Q)- Bureau f 
2 - Oklahoma City 
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4 s 
From: CRANSTON, SENATOR ALAN FEDERAL GOVDGANENE 
To: OLA 
Date Received: O2~13~84 Bate Due: G3-01-84 Control #: 402L307L07 - 


Subject & Date: 
02-08 LETTER ON BEHALF of [7—————____- 6 
OBJECTING TQ METHODS USED BY FBI IN A RECENT INCIDENT IN b7c 


IRVINE. fan o 
(nary Feam 2) 
a ae 
Referred To: Date: Referred To Date: 
(1) FBI) WEBSTER 02-14-34 (5) File: 
(2) (6) 
(3) CF) Prty: 
(4) (8) Zz 
Interim By: : fate: Opr: 
Sig. For: FBI Date Released: HED 
Remarks: 


iC GLA. OLA TO MAIL INTERIM RESPONSE. noe . Bee 
RETURN THIS FORM W/Z COPIES OF REPLY TO EXEC. SEC., 4 ‘ ™ 
ROOM 4416, EXT. 3:305. 


be 


Other Remarks: bie 


rig nals retrduet- . eee / Yb - 4. 3— 4b 


5-3-8 ee 
7 aad mms 6 Be \i 
\ xy ip ORNOLOQURE ATTACHED? 
~ ENCLOSURE 
"7 APR 12 1984 


[Ne-f U3 GE 


Wniled Dtates Denate 


WASHINGTON, D.C. 20810 


February 8, 1984 


Congressional Liaison 
To: Department of Justice 
Constitution Avenue and 
10th Streets, N.W. 
Washington, D. C. 20350 


Enclosure from: 


Re: . : 
Please respond to this constituent's concerns re the 


FBI's methods and their response to charges re enclosure. 


I forward the attached for your consideration, 


Your report, in duplicate, along with the return of the enclosure 


will be appreciated. 
rely, , 


an Cranston 


Sin 


Please address envelope to: 
Senator Alan Cranston 
112 Hart Senate Office Building 
Washington, D.C. 20510 


Attn: 


b7c 


Nt-V9/3 “So 


bé 
Dear Senator Alan Cranston, bic 


As a resident of Irvine, I am deeply concerned with the 
tactics the FBI used in our city a few days ago. I feel 
the local newspaper :The Register" has hit the nail on 
the head. ‘I have enclosed a copy of the article for you 
to read. The laws were not made to harass people, but 
to protect them. 


You as an elected offical are put into office by the 

people in essance you are our voice. I would like you 

to look into this incident and see what can be done 

about the FBI. Please find out why they acted in the manner 
discribed. If this is allowed ti pass by without an outcry 
from us, they will feel they can continue to confiscate 
anything they please in the future. I am looking foward to 
hearing from you on this matter and seeing what action you 
will take. 


Thank you in advance for your attention in this matter. 


bE 
BIC 


[be ¥U3-36 


February 14, 1984 


Honorable Alan Cranston 
United States Senate 
Washington, D.C. 20510 
b6 


Dear Senator Cranston: 


This is to acknowledge receipt of your letter of February 8, 


(poet xecelved py the Department on February 13, 1984, on behalf of 
b6 


b7C 
A further response will be forthcoming as soon as possible. 


Sincerely, 


Robert A. McConnell 
Assistant Attorney General 


Cc: Exec. sec, WY >» OLA 
4021307107 


M9g- W336 


m4 


{ A12 The Register 


i 
Monday, Oct. 17, 1983” 


| “There is no security on this 
“jo garth; there Is only 
{ | opportunity,”" 


Gon, Douglas MacArthur 


t The fie 


A division of Freedom Newseppors, Inc. 


v 
R. David Threshie Jr., publisher 
K. E. Grubbs Jr., editorial pages editor 
N. Christlan Anderson, editor ‘ 


RC. Hoiles, co-publisher 1935-1970 
C.H. Hoiles, co-publisher 1935-1979 
Harry Hoiles, co-publisher 1975-1979 


few weeks ago the Woodbridge 

Az: in Irvine was leafletted by 
local police. Residents were 

warned to be careful about opening the 
door to strangers. The purpose, every- 
one thought, was a rash of rapes in the 
area. In light of subsequent develop- 
ments, does it almost seem like an 
advance warning that the FBI was plan- 
hing a dawn raid on teenage computer 
hackers? No, it couldn’t be. 

: The way the FBI conducted those 

4 raids, even the fact that raids were 

conducted at all, raises disturbing ques- 

tions. You might not be surprised at 

i } ‘such activities in Nazi Germany or the 

: Soviet Union. But in Irvine? ! 

! Based on information released to 
date, the four Irvine teen-agers were 
among perhaps a dozen in different 
parts of the country who may have 
tapped into the commercial Telemail 

i system run by GTE, using it to send 

, messages without paying the fees com- 

mercial clients pay. 

If that’s the extent of their weongdo- 
ing, some law enforcement officials 
could have talked to the boys and:their 

"parents, explaining what they had ‘done 

and informing them they would receive 

bills for their unauthorized use, 
*4Perbaps something more serious :is 
afoot. Perhaps these boys have, 
inadvertantly or not, tapped into’ 

-thing else. Perhaps federal authgelties 

mally want to get at the mysterioug San 

lego fellow they know as The Cracker, 
who reportedly told the Irvine boys how 

x telget inte the Telemail system and may 

be into heavier things. If so, the low-key 


well have been the best way to do it. 
. Instead, the FBI conducted a heavy- 


When one family didn't answer the door 
{at 6:15 in the morning!), an agent 
actual ly broke into a boy’s bedroom. 
Fat ‘agents seized computers and com- 


FBI storm tactics in Irvine 


months. Yet some attorneys believe that 


approach, seeking cooperation, could © 


hapded, heavy-footed raid at dawn.- 


puter equipment, much of it expensive.” 
There's doubt now about when (ifever!) 
the boys will get their equipment back, 

Were these boys running a murder: 
ring or something to justify such tac- 
tics? Hardly. To date they haven’t been : 
arrested or even charged with a crime. 
Yet the FBI has stolen (yes, that's the ;- 
proper word) their equipment and may. 
or may not give it back. . 

This should be a real shocker to any- : 
body who believes the United States is, 
or ought to be, a free country. 

It's difficult to see why the computer. 
terminals were seized. In and of them- .." , 
selves, they can do little to establish 
what the boys did with them: If the FBI 
needed to establish that the boys had 
terminals, they could have made out a 
sworn statement to that effect and had 
the boys and their parents sign them. | 

Furthermore, if the boys.really were 
up to something devious, taking their ‘° 
computers is a small deterrent. Access 
to computer terminals is relatively 
easy. Is the FBI prepared to confiscate 
everyone’s home computer? 

- Tt is asad day when law enforcement, 
can walk into someone’s home and 

property for an undetermined amount of 
time when a case is in its initial, stages 
and indictments may not be sought for 8 


if no indictment is issued, the’ ‘parents” 
may have to sue the governme! ta get. 
their boys’ property back!" © & 
The FBI should put up or. shut up: “ 
Either charge these boys with a crime 4 
and start’ prosecution immediately, or 
give them back their property. If no 
indictment is sought, the computers 
should be accompanied with a contrite 
apology and compensatory damages. 
Those responsible for this outrage 
should be punished or fired. 
Otherwise, the FBI is operating on the 
same moral level as a burglar. 


Exec AD Adm. —_— 
Exee AD Inv. 
Exec AD LES —_ 
Asst Dies 


| \ ioe 


March 2, 1984 


fenorable Alan Cranston 
United States Gosate FEDERAL GOVERNMANS 


Washington, B. G. 20520 et 
Beac Senator Cranston: (16) FRAY < 
Bie 
/ 


a gory @th communtoation on behal? o2/ 
hag been referred to the PBZ for reply. .~) 


Bince the tavestigation te ekich your conetiiuent 
sefeca le snagelag, i¢ would be inappropriate for me to comment 
speoiticaliy on any aspects of the caan at this time. Howaver, 
Xwould iike to agaplain tha PRI's investigative procedures 
and responsibilities in puck investigatiess. 


When wo cecaive information indicating that 2 
violation of & Federal law haw occurred, ia eveurting or 
WILL aceur and we determine there are theme of evidentiary 
value, we obtain a jadiolally authoriead aearch wargame feu 
the promises where the ovidenos is beliaved ta be loontad. 
As with ang search warrant, the avidence Belag avught must 
be specificaily descriped, ac muet tha lecation to be searched. 
the time of exeoution of the seatch warrant ie gezally decided 
upon Setwean the investigating Agent am) the Pederal provecutor | 
based on goveral aceds, the moat iopoytant of which would 
be the proteotion of the evidence. Althosgh persona. con~ 
venience bo the ousteata ia a consideration, < la secondary 
te pratection of the eriderce. Whan the PBI ie conduoting : 
an invertigation, the feet that sone of the alleged acre reaiee 
may ba juveniles dous not diminish the sariouaneaa of tha 
azine, aor dees it lessen the PBI's responaibility te protect - 
the wietiag from durther iileqal activity. 


i hope thie information will assist you in cespondiag 
to aad XY am cetursAng your enclosggres as cequesged. 
macy Yate; 

Oliver B. Revelh 


Aasistank Bisector 
Criminal tavestigative Division 


Bacloaures (2) [% C73 i 
~ Executive Seccatariat - Enclosures (6) : 
Reom 4416, GOS SSS eee on 
~ Alexandcia [296A-033) ~ Enclosures {3} 


~ tog Angeles ~ BPnelesuces (33 Ber 

sane mare Enclosures (5) MAR 6 994 

- Mimastractive Unit, CID, Room 5121 hea ee 
cba 


- Congressional Affairs Unit — Ack, : 


Brererw ts 


srfw (12) SEE NOTE PAGE Two 
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Henorable Alan Cranston 


“NOTRs 
writes to Senators Cranston to show his diasatisfaction with 


the manner in which the VBI recovered computer equipment 


ayster run by GTZ. 


: _ storm tactics in 
_ 2 


te the PBI by Congressman Robert E. Badham. 


who ia not identibfable § 


jn Bufiles, 


b6 


which was allegedly used in tapping inte the commercial Telemail 

He enclosed a néwepaper article entitled bic 

irvine.” Reply coordinated with Sa 

white-Collar Crimes Section, CIB, ané portion 

eaponga taken from cesponse to a similar letter referred 
APPROVED] “Adra. Gory, 1 Capa Cabs, “aes 
a en ydflan. el a 

Owector vein Oi fan — 
Exec. AD Agim. is anne : 
Exec. AU Inv, ana 


“Ut of Come: & 
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OC Teletype OC Immediate o . 
O Facsimile 0 Priority o 
&) _ALTRTEL Q Routine a ’ 
O UNCLASEFTO 
CG UNCLAS 
aa so aia 
TO: : DIRECTOR, FBI 
be 
FROM: SAC ALEXANDRIA {196A-633) (P) bic 
MAINFRAME __) 


FBW] CONSPIRACY 
O00:ALEXANDRIA 
Re Bureau letter to Alexandria dated 2/15/84. 


Enclosed for the Bureau is Alexandriasairtel 
dated 11/14/83. 


Enclosed airtel is Alexandria's response to 
Bureau letter dated 10/27/83. 


2 Be 
Jio~ 1}/o~ 
©- Bureau (Enc. 1 
- Alexandria . 
CMK: liv 
(4) 


em GD 


1a. FEB 25 1984 


OES oy 


1* 
af" 
a : qe \ bye 
Approved: mitted oe Per 


(Number) {Time) 


vi 


we abcees sks 
é CLAS Ps 
: te 21/18/83 


[ TO: DIRECTOR, FBI 
FROM: SAC, ALEXANDRIA (196A-633) (P) 


MAIN FRAME 
FRAUD BY WIRE; 


CONSPIRACY 

(00: AX) 

eee bé 
FRAUD BY W3 > ITSP b7C 
(00:MI) 


Re Director's letter to SAC, Alexandria, 10/27/83. 


Enclosed for the Bureau are two packets containing 
copies of evidence obtained in the "Main Frame" investigation. 


Packet number one contains copies of printed. and 
hand-writt f the residence 
located at 
residence 0 
isL__lyears-old and quotes in a recent Detroit newspaper Indicated 
he claims to have penetrated Arpanet. The printed material b6 
in packet number one is apparently a listing of every Arpanet pic 
and Milnet host with the "connect address" or host number for 
each, The -hand-written material also contains host names, 
connect addresses and also includes some user names and 
passwords. There is reason to believe that this information 
was shared freely with other hackers. 


2-Bureau (Ene. 2) 

2-Albany (Info) 

2-Buffalo (Info) gh) 
wh 


2-Detroit (Info) (nt 
23 
ED. 


2-Los Angeles (Info) 


2-New York (Info) 

2-Oklahoma City (Info) (GGA -OF 93 
2-Omaha (Info) si D. INYENED 
2-Phoenix (Info) 3 of 

«San Diego (Info) 


Transmitted _. Perr 


Approved: 
(Number) (Time) 


Ax om & 
Packet number two fnowncas[to ee lena 
has bee 


ts unknown. Information contained in packet bIC 
number two was apparently obtained from some other sources 
(one being the Defense Data Network Newsletter) and then 
entered into telemail to be shared with other hackers. 


For information of the Bureau, all offices 
conducting searches in the Main Frame case (Albany, 
Buffalo, Detroit, Los Angeles, New York, Oklahoma City, 
Omaha, Phoenix and San Diego) were requested to forward 
all evidence to Alexandria for analysis, therefore this 


response may constitute completion of lead in referenced 
letter for those offices. 


' 
i 
i 


28 


F0-36 (Rev. 8-26-82} y y 
° ; ) FBI ) 
TRANSMIT .VIA: PRECEDENCE: CLASSIFICATION: . - 
O Teletype. O Immediate a . ‘ 
O Facsimile Ci Priority im) 
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UNCLAS 
Date 3/19/84 
TO: DIRECTOR, FBI 
FROM: IC, NEW YORK (196B—-2942) P 
: A CE ’ 
SUBJECT: MAINFRAME” 
BW 
(00:AX) 
bé 
FBW; ITSP , 
(00: MILWAUKEE) ive 


neBullfSto AX, et al dated 10/27/83 and 1/12/8.. 
For information of the Bureau SA 


airtel to the Bureau dated 11/14/83. 


Resident Agency of the NYO. 


y Gé—- L/ US ~3 


of the 
Alexandria division furnished ese information by Alexandrda 


MAINFRA is currently an active case ih i auppauge 


 SEEIL 
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wae ee tee a 

‘ 2 MAR 20 184 4 3 
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1- New York ie; 
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Approved: Transmitted Per “ 
: {Number} {Time) 3 


FD-36"(Rev. 5-22-78) . r] a. : f 
» boos 


UNCLAS EF.TO 
UNCLAS 


i} 

FBI H 

TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
Teletype (J Immediate TessseraIt H 
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TO: DIRECTOR, FBI (T3SS533)- 
may -~ (Atten: Technical Services Division-Room 7159) 


YO 
rr sour sac ETROIT (28E-847) (C-6) 


Bars FRAME 


\ FRAUI FRAUDBY-WIRE; 

CONSPIRACY; 

(00: ALEXANDRIA) 

Alexandria File Number 196A-633 


UNAUTHORIZED ENTRY INTO GENERAL \ 
TELEPHONE AND ELECTRONICS; \ a 
TELENET SYSTEMS CUSTOMER COMPUTERS; yw } 
FRAUD BY WIRE; \ 
ITSP; x 


(00; MILWAUKEE) 
Milwaukee File Number 196B-798 
Bureau File Number 196-4578 


Re Bulets to SAC, Alexandria, Et Al, dated 10/27/83, 
1/12/84, and 2/15/84, captioned as. above and Alexandria 


The information being requested of the Detroit 18 
Division was obtained as a result of executing a search 
warrant on 10/12/83, in the Main Frame investigation. 


‘bE 


airtel to Director, dated 11/14/83. / 4. : of Wor ap 
ols 4934 


b7c 


Per 


Transmitted 


Approved: 
(Number) (Time) 


U.S. GOVERNMENT PRINTING OFFICE + 


1992 0 - 369-895 
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DE 28E-847 


Per instructions of the office of origin, ali documents seized 
were forwarded to the office of origin on 10/21/83. ‘The 
airtel from Alexandria to the Bureau, dated 11/14/83, advised 
that Alexandria was in possession of all documentation seized 
by auxiliary offices in the Main Frame matter and the package 
submitted by Alexandria was to constitute completion of the 
lead for Detroit and other offices involved. 


There was-no response to Bulet, dated 1/12/84, by 
Detroit due to statements in the Alexandria airtel to Director, 
assuming responsibility for covering the requested lead. 


a Technical 

Services Division, Room 59, on 2/ referencing Bulet, 

dated 2/15/84. Se se the lead to 
atisfie 


Detroit had been s by Alexandria in their airtel, 
dated 11/14/83. 


b6 
b7C 


Memorandum é e 


Ts | \CSERECTOR, FBI Date 2/8/84 
\ ( {ATTN : TSD, ROOM 7159) 
From: SAC, BUFFALO (1964-529) (P) © 
; Subject: “+. MAIN FRAME . 
G FBW; CONSPIRACY \ 
G (OO: ALEXANDRIA) . 
(AX File 1964-633) . 


IN 


b6 - 
EY AL ; vs 
UNAUTHORIZED ENTRY INTO GENERAL 
TELEPHONE AND ELECTRONICS (GTE); ras 
TELENET SYSTEM CUSTOMER COMPUTERS ; 
FBW; ITSP 
(00: MILWAUKEE) 
(MI File 196B-798) \ 
{Bureau file 196-4578) 


ha 


UNRECORDED COPY FILED 


” 


Re Bureau let to Alexandria, 10/27/83, and Bureau let 
to Alexandria, 1/12/84. 


The Buffalo Division's response to above caption 
matters and referenced letters is negative. Investigatio 
continuing, however, in the Buffalo Division. 


@- Bureau . / 
- Alexandria 


2 - Buffalo 


JK:bar 
(6) 


FD-36 (Rey. 5-22-78) 
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Teletype immediate ! ‘ 

Facsimile Priority t 
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TO: DIRECTOR, FBI | 
(ATTN: TECHNICAL SERVICES DIVISION, ROOM 7159}. 


FROM: SAC, ..BOSTON 


supgecr: Charm FRAMES) 
FBW; CONSPIRACY 
(00: ALEXANDRIA) - 
< (AX: 1964-633) ~~ 
(BS: 19€A-1229) 


“BD IY 


UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND 
ELECTRONICS (GTE}; TELENET SYSTEM CUSTOMER COMPUTER 


FBW; ITSP 
(00: MILWAUKEE) 
(MI: 196B-798) 
(BS: 196B-1160) 


ED COPY pr 
Y 


UNRECORD: 
L964, 


Re Bureau airtels to SAC, Alexandria, 1/12/84 and 
2/15/84; Boston letter to the Bureau, 1/19/84, and..Boston airte. ‘” 
to the Bureau, 11/29/83,, regarding captioned ma ees GB HD 


Enclosed ‘£9 iche/ Bureau is a copy of ES once Boston 
letter dated 1/19/84, fand Boston airtel dated 11/29/83, in response 
to above captioned ma tersywhich the Bureau is apparently not in 


receipt of. gow? 
(o)- Bureau (Enc. 2) 


2 - Boston (1 - 196A-1229) 
(1 - 196B-1160) 


WGS/dw 
(4) 


es 


y 


SY im AK” 
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emorandum — ‘ ° Look R 


J ‘> 


“DIRECTOR, FBI Date 1/19/84 


From : SAC, BOSTON (196B-1160) (RUC) 


Subject: MAIN FRAME; 


FBW; CONSPIRACY 
00: ALEXANDRIA 
AX: 196A-633 


bIC 


UNAUTHORIZED ENTRY INTO GENERAL TELEPHONE AND 
ELECTRONICS.-(GTE) ; TELENET SYSTEM CUSTOMER COMPUTERS; 
FBW; ITSP 

00: MILWAUKEE 

MI: 196B-798 

BU: 196-4578 


Re Bureau letter to Alexandria, 1/12/84 and Boston 
airtel to the Bureau, 11/29/83. 


Enclosed for the Bureau are two copies of Boston's 
RUC airtel dated 11/29/83, which responded to Bureau letter 
to Alexandria, Et Al, dated 10/27/83. The airtel is self-explanatory 
in that Boston, merely being a lead office for Milwaukee, 
had no information relative to the request of the Bureau. 


2 - Bureau (Enc. 2) 


2 - Alexandria (196A-633) a 

2 - Milwaukee (196B-798) tin 
- Boston 

wos /dw 


(OE 


Fe DOs 


ERCLOSURE 


11/29/83 


. eo ALEXANDRIA) _ 
_ AX File: 1960-633) 


. ; “Boston fimotionéa as an en auciliaty office in the above captioned 
Mitwesiee case. Therefore, Booton is not in possuseion of may @rtan) materials 


ENCLOSUte 


ats C ren cry 
bs: 1969-1160 é > 


the computer. A search was conducted at the Boston Division for the 
missing enclosure. Yt is believed that the enclosure was inadvertently 
left off the airtel. 


» No further investigation outstanding in Boston. This matter 
‘a been placet in an HOC status. : : 


AKOGIS 


194 01257 ‘@ 


©RE HQ NY 


TS htt 
> cot, AB HAY: ee 
26. LO LES aeeweeen 
jAsct Bir. 
. e Rar. Barve. 
DE AX nm, inv. 
R G12 21002 APRIL g4 \ hoe 
FY ALEXANDRIA (1964-633)/ (PD 


TO DIRECTOR ROUTINE 


Laoratory as 
fagal Coun. 

OH. ef Congs 
QyPublic Atta. 


NEW YORK ROUTINE 
f2T 


> UNCLAS 


(/CRBUL NEY YORK - BOMRA, HAPPAUGE Ra, Sal _—id 
ve 
" "MAINFRAME'Y FBW3 CONSPIRACY (00 28%) 


RE ALEXANDRIA TELETYPE TO THE BUREAU DATED AUGUST 27, 
L 


b6 
A 19833 BIC 
ND ALEXANDRIA PROSECUTIVE SUNMARY DAZED FEBRUARY 17, 1984. 
PERMISSION IS REQUESTED FoR Sal —=*d; TQ. TRAVEL TO 
NEW YORK ON AGRIL 19, 1984, TO CONDUCT INTERVIEWS gf SUBJECTS Pe 
es (| a 
ausaL—S—S™—~—~—sSCED VA, HAS DRAWN UP AN AGREEWENT WITH 
THE ATTORNEY REPRESENTINe BOTH JAND[L___} IN RETURN FOR 
THEIR STATEMENTS CONCERNING THE ACTIVITIES 7) ne © Ka re 
[_} ON cre TELEMAIL, ay Sa DECLINE P90 SECUT IO# 
oreo 7} c/a 
ee aa 
he 6 APR 19 84 


ee 
Be qe 


be 
b7c 


PAGE TWO AX 196A-655 UNCLAS 

[___]t tHE MOST SERIOUS OFFENDER THAT HaS BEEN POSITIVELY 
IDENTIFIED anp[__———~C*dOF THE "PHALSERS",. THE "PHALSERS” 
THROUGH THEIR ILLEGAL USE OF TELEMAIL SHARED STOLEN ACCOUNT CODES 

AUD PASSYORDS FROM NUMEROUS COMPUTER NETWORKS INCLUDING CTE 

TELENAIL, IBM, AUDIO DISTRIBUTION SYSTEXSAND THE DEFENSE aD VANCED 

RESEARCH AND PLANNING AGENCY SYSTEX CALLED "ARPANET".[__|Has 
(etc ae 
DETAILS THE INVESTIGATION INTO THIS MATTER. 

[Jean Proving FIRST HAND INFORMATION aBouT[ | 

METHODS AND FREQUENCY OF ILLEGALLY ASSESSING VARIOUS COMPUTER 

SYSTEXS AND HIS METHOD OF DEFRAUDING VARTOUS LONG DISTANCE PHONE 
SYSTEMS. 

[_Jeax PROVIDE INFORMATION ABOUT THESE SAME ACTIVITIES as 
wELL aS—O™OC™~COCC#CdUT HAT. RESULTED Iw[L__] 
tit TATELY BEFORE THE FBI EXECUTED A 
SEARCH WARRANT IN THAT ROOM, 

THESE TWO INTERVIEWS aRE EXPECTED TO BE VERY DETAILED aND TO 
REQUIRE THE INTERVIEWER TO HAVE PRECICE AND EXTENSIVE KNOVLEDGE OF 
THIS ENTIRE CASE. FOR THAT REASON, PERNISSION IS REQUESTED FOR 
sa[_______]T0 CONDUCT THE INTERVIEWS WITH THE ASSISTANCE OF SA 
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PAGE THREE AX [96A-633 UNCLAS 


[)) arPauce Ra. 


SAC'S ALEXANDRIA AND NEW YORK CONCUR. 
BT 


b6é 
b7c 


{ 4/14/64 UNCLAS ROUTINE 
SFORISRR AX NYDDE H@ dOO99 SdEYUSR 131810Z APR 84 


FM DIRECTOR, FBI 


ws 

th TO FBI ALEXANDRIA {19bA-633} ROUTINE 
FBI NEW YORK ROUTINE 
BT 


UNTEAS. ~ 
Onazuerane> FBUS CONSPIRACY 00: ALEXANDRIA. 


RE ALEXANDRIA TEL TO THE BUREAU DATED 4/12/84. 
FBIH@ AUTHORIZED INVESTIGATIVE TRAVEL OF SAL] ne 
[J FROM ALEXANDRIA TO NEW YORK AS SET FORTH IN bc 
REFERENCED TELETYPE. 

BT 


fh U2 4 


Vig dy JCSIKLA £43 4/13/84 3a4a/b° S44 


~ eA 
1 - FOF Wz ger 29 © 
. ee 


No 
ISR BUREND BF wNvEOTE 
end BONMUNIEATIONS EGRTEA 


sewn | 
6 yb? ee PRA DIBES—~ 


AXOGIG 12918272 neces 


= UNIT 
"PX SD, 


DE AX 


+ FR @SIBH6Z MAY g4 
pps Fit ALEXANDRIA (196A-633) 
"ro pIREcTOR ROUT INE 

ALBANY ROUTINE 
BUFFALO ROUTINE 
CHICAGO ROUTINE 
DETROIT ROUTINE 
LOS ANGELES ROUTINE 


NEUSYORK (MANHATTAN) ROUTINE 


OKLAHOMA CITY ROUTINE 
OMAHA ROUTINE 


PHOENIX ROUTINE 


SAN DIEGO ROUTINE 
BT ii 


UNCLAS 


Ey YORK~-BROOKLYN-QUEENS MRA (HAUPPAUGE RA) 


Ba weraus; Fos CONSPIRACY (OOzAX) /9@~ YTS i 
a 
2 OMY 8 tage 


RE ALEXANDRIA REPORT DATED FEBRUARY 17, 1984, 


woe > 


PAGE THO AX 1960-635 UNGLAS 

FOR INFORMATION OF THE BUREAU AND ALL RECEIVING OFFICES, on 
NAY 7, 1984, THE FOLLOWING SUBJECTS WERE INDICTED BY THE FEDERAL 
GRAND JURY, EASTERN DISTRICT OF VIRGINIA, FOR VIOLATION OF TITLE 1, 
UNITED STATES CODE, SECTION 1343, aS PoLLows:[ =| 
countsys—S™S™—~—~wdS cs S—S—S—S—S—=SdCS 
counts); =i). 

ausa[_———S=«dAL SO FILED CRIWINAL INFORMATIONS ON THE 
FOLLOWING SUBJECTS FOR VIOLATION OF TITLE 47, UNITED STATES CODE, 
secriow 225 c1) B>s[ 
axp[ 


PROSECUTIVE SUMMARIES ON THE FOLLOWING JUVENILES WILL BR 
FORWARDED FROM THE UNITED STATES ATTORNEY, EDVA, TO THE APPROPRIATE 
UNITED STATES ATTORNEY FOR DISSEMINATION TO LOCAL AUTHORITIES: 


b6é 
b7c 


be 
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‘ cesses 


you . . 
yer 
A hes 
LNU AE b7C 
: “CIRCLE: @PHALSERS; ET AL; 
UNAUTHORIZED.ENTRY INTO! BAL CTELEPHONE 


E RONICS (ere) SELEMATE SYST: FBW5. 
CONSPIRACY; 00: ALEXANDRIA 


PURPOSE: 


To provide update information including the pgborg of four 
indictments and the filing of four informations concer ine 4 this 
investigation of unauthorized access into the sere HOW eahone and 


Electronics Company (GTE) Telemail system. 


RECOMMENDATION: . 


a ae only. 


Kop 


sens. _. 46 


Le gy oo hfe fi; 

GTE owns and operates a comptite f network known as. Telenet 
which links various subscriber businesses and government agencies 

in numerous cities. Within Telenet is a service known as Telemail 

which offers computerized message capability between Telemail customers. 
During September, 1983, GTE learned that their Telemail system had 

been accessed by unauthorized intruders. The intruders obtain subscriber 
passwords and create "bulletin boards" which provide access and Other 
information to other intruders. 


scs:3fgul (10) 


1 - Mr. Baker — 
1 - Mr. Revell 1 - 
1- . 1- 
1- 1- 

gue 1- 


(CONTINUED - OVER) 


Fet/DOs 


to Mr. Revell Memorandum , be 
RE: UNSUBS; bic 


Investigation by Alexandria identified three loosely 
organized groups or circles of intruders. The "Innér Circle" 
consisted of younger intruders some of whom are in the Milwaukee, 
Wisconsin area, and who are known as the 414s (telephone area code); 
the "Phalsers" have penetrated and eliminated some records and 
communications associated with Coca Cola Com aytheon; b6 
and thel___Jgroup (short for which b7c 
operate out of the Oklahoma City, Oklahoma area. These groups 
are known to have penetrated Telemail user companies and agencies 
such as IBM; NASA; Jet Propulsion Laboratory; Time, Incorporated; 
TRW; Hughes Aircraft Corp.; Northrop Corp.; U. S. Department of 
Agriculture; BMW; and National Systems Management, Inc. Additionally, 
the "Phalsers" gained access to the Department of Defense (DOD) 
ARPNET system. 


On May 7, 1984, the Federal grand jury, Alexandria 
Virginia, returned true bills of indictment chargin: 
and with 
multiple violations each of violating Title 18, U. S. Code, Section 
1343 (Fraud by Wire ~ Felony). Criminal informations were also 
filed chargin: 


with violation of Title 47, U. S. Code, Section bIC 
Harassing Telephone Calls, a Misdemeanor). Prosecutive 
summaries on the following juveniles will be forwarded by the 

United States Attorney’ (USA), Eastern District of Virginia, 
the ropriate USA for dissemination to local authorities: 


Further, prosecutions in the Milwa e€ area concernin: 
intrusions into GTE are as follows: and 
have either pled guilty, or Indicated they will 
plead guilty to Title 47, U. S. Code, Section 223(1)(B). Further, be 


one to five additional subjects will be given the opportunity to 

plead to this misdemeanor and those who deciine to do so will be 

prosecuted for Fraud by Wire violations (Felony) according to the 
USA. 


Any significant developments will be brought to your 
attention. . 
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FM ALEXANDRIA (196A-633) 
TO DIRECTOR ROUTINE 

BT 


UNCL A: 
aN 
MAINFRAME 3 \FBU coe 


i Asiana 


RE ALEXANDRIA REPORT DATED FEBRUARY 17, 1984. 


[_]APPEARED BEFORE JUDGE JAMES C. prc 


CACHERIS, EASTERN DISTRICT OF VIRGINIA, ALEXANDRIA, VIRGINIA, AND 


ON JUNE 14, 1984, 


PLED GUILTY TO TWO COUNTS OF VIOLATION OF TITLE 18, SECTION 1343, 
SENTENCING WAS SET FOR JULY 12, AT 9:62 AM. 
BT 


9 JUN 19 1984 
em te 8 ete 
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TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
Teletype © Immediate q 
Q Facsimile Priority G 
Ck _ AIRTEL QO Routine QO 
O UNCLASEFTO 
O UNCLAS 
Date 5/16/84 


TO: DIRECTOR, FBI 


FROM: SAC, ALEXANDRIA (196A-633) 


3 
a 


FBW; CONSPIRACY 
(00:AX) 


{P) 


Re Bureau routing slip to Alexandria gated 
Ce 
Enclosed for the Bureau are six copies of an 


LHM suitable for dissemination as requested in referenced 
routing slip. 


5/8/84. 


icc LAn/uia $783 
S Share. 
7s 


Ip (prsrean (Enc. 
Alexandria: vy 


uf or 


* MAY 18 t9¢4 4 


GDF:gaj é 
, (4) wer see en} 
1* 
Approved: Transmitted Per 
(Number) (Time) 
U.S. Government minting Offlen: 1984—421.619/6288 
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UNITED STATES DEPARTMENT OF JUSTICE ( 


FEDERAL BUREAU OF INVESTIGATION 


In Reply, Please Refer to Alexandria, Virginia 
File No. May 16, 1984 


MAINFRAME; 
FRAUD BY WIRE; 
CONSPIRACY 


Investigation in this matter was initiated 
based upon information received from the General Telephone 
and Electronics (GTE) Telemail Service indicating that 
numerous unauthorized users has been detected in the 
accounts of approximately 18 customers. Telemail is 
an electronic mail service with approximately 150 user 
companies including some federal agencies. 


The unauthorized users (hackers) gained access 
to Telemail by calling the local GTE Telenet number and 
entering the word “mail" upon prompt by the Telenet computer. 
Using legitimate user names provided by other hackers, 
subjects in this matter would search (manually.or by 
a@ computer program) for a "default" password. In this 
case, new users had their passwords set at "A" and were 
urged by Telemail to create their own confidential password. 
Many users, however, left the password at "A" or used 
their first names as a password. This information was 
routinely available on numerous computer “bulletin boards” 
around the country. s 


While this investigation did not encompass 
other computer systems, frequent references and information 
concerning the Department of Defense Arpanet and Milnet 
systems were found. The names of every Arpanet and Milnet 
host computer and the “connect address" of each were 
shared freely among hackers. Further, actual user names 
and passwords for access to at least one Arpanet host 
(Mitre Corporation) were also available. 


ae, -ff - 


RE: MAINFRAME 


The hackers also routinely obtained information 
from the Defense Data Network Newsletter and shared this 
with other hackers. 


The unauthorized computer accesses discovered 
in this matter were in computer systems designed to be 
“user friendly” and available to users through local 
telephone numbers. 
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FD-515 (Rev. 9-24-82) 
ACCOMPLISHMENT REPORT 


5/31/84 


Date 


Investigative Assistance or Techniques Used 


Bureaw Fila Number 


Were any of the invastigative assistance of techniques listad below used in connection with accomplishment] 


TO: } pIECTOR, FBI 
ai 


lbeing clsimed? [-] No (] Yes - it Yes, rate each used as lollows: 


1 = Used, but did not help 


ALEXANDRIA 196A-633 2 = Helped, but only minimaly 
3 Agsistance Tite I Field Support ‘Sqd Asst 
oo 7 ypnosi Fen ie SWAT Team 
Is computer 3 ent ia Pharogeanie 5 Tashore Tou 
O -xiaiem eBIDER or | pcitance eisence Covenge rocos 
‘operation, 4, Consensual 9. Informant 14. Polygraph 20. Undercover 
DD - xit case invoves Monitoring information Assistance Operation 
cqugioniepute, | ESO ios ow 5. Gearon Wateoss —T81 Wu eT 
Local}. FISC Exams Execuled Analysis (VIA) 
[aA. Preliminary Judicial Process Complaints | Informations | _indiconents fe. Recoverles, Restitutions, Court Ordered Forfeltures or Potentiat Economic Loss Prevented {PELP) 
(Number of subjects) ~ 
4 4 Property or 
8. Arreois, Locatea, Summonses ‘Subject Priority (See Reverse) ELP Type} Potential Economic 
s $ s '$ 
$ $ is S$ 
$ $ is Ss 
unter ot Subjects oF Anowt Who Physica Rested 
Number of Subjects of FA Arrests Who Were Armed s s iS S$ 
‘Gaminat Summons 7 ‘Subpoenas Served $ $ i$ s 
Ic. Retenao of Hostagea: (Number of Hostages Reteasod) |e. Chvil Mattere Goverment Detendant Govemment Plaintift 
Amount of Suit Is is 


F. Final Judtclat Prac Judicial District 


(Use fwo letter state abbreviations per U.S. Post Ottice Guide. For Example - The Northern District of Texas as NO TX; The 


Devic State Distict of Maine es ME in the state fiokd ony.) 
‘Subject 4 - Name ‘Subjact’s Doseriptlan Code * - 
Tanvetion edall Term Suspended Probation 
(a Pretrial + Convictions - IC) Fetony Title Section Counts Yrs Mos Yrs Mos Ys. Mos. Fine 
Diversion: Enter conviction and Misde- Is 
2) dismissal} | sentence data in space at meaner 
CC scquita} | rant. tr more than tour id 
sections ara involved, imit to |] Plea 
the four most relevant. b s ——s 
Thal 
| 
ei 
[supject 2“ Name - Subject’s Dessiptions Gongs! =f” 
Canviction Teel! Term Suspended ropelok JPL, 
[a] roti - Convictions - DD Felony [rite ‘Saction Counts Yis_[ Mos Ys | Mos. Yee Jif Mos 
version é 
Enter convietion and Miade- 
5 Smeal fees (Ce (LZ 
(accuita! | |rignt, more tan tour 5 \ 
sections are Involved, limit tof Plea x] 
‘the four most relevant. "| 
CT tal 
‘Subject 3 - Name - Subject’s Description 
Gonvietion Taal Term Suspended Probation 
[ona conten. | 00 [aT Setor [oasis fer ff es [af 
version Enter conviction and Misde- 
cose] [Rommcranemonon ar | em 1 a 
I sequitas| ght ere tan tow NALD ALPE GT 
sectons are involved, mit to| LJ Ftea Tip tr Sp oe ri 
the four most elvan im f 
O ta 
{Tal 
Attach eltfonal forms H reperting tinal judicie? process on more than thrge subjects. - 
Roms; On 5/7/84, four subject: indicted by FGJ, EDVA for violat 
T 18, USC, Section 1343, as\ fbllows: (10 counts), - 
five coun by (five counts), ec 
4 7 7 
(three edints)-Violation of T. 47 USC, S 223 
He) 
927 bureau PAVE ; 
2 Field Office (1-%96A-633) (1-Statistics In Process) GDF:llv (4) 
* See codes on reverse side. Subject description codes in Section F are required onty when reporting a conviction. Ss 
+> tdanty the olher Federal Ageney(es) in the Remarks Section, JOP 1/005 


Property Type Codes* Potential Economic Loss Prevented {PELP) Type Codes * 


peel 33 ONY 


Code Code 
No Description No Description 
1 Cash (U.S. and foreign currency} 21 Blank Negotiable Instruments or Tickets 
2 — Stock, Bonds or Negotiable Instruments (checks, travelers checks, 22 Counterteit Stocks, Bonds, Currency or Negotiable instruments 
money orders, certificates of deposit, etc} 23 Counterfeit or Pirated Sound Recordings or Motion Picture’ 
3 General Retail Merchandise (clothing, food, liquor, cigarettes, TVs, etc}} 24 Bank Thett Scheme Aborted 
4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) 25 Ransom, Extortion or Bribe Demand-Aborted 
5 Heavy Machinery & Equipment theavy equipment, computers, etc) 26 Theft From, or Fraud Against, Government Scheme Aborted 
6 — Buik Materials (grain, fuel, raw materials, metals, wire, etc) 27 Commercial or Industrial Theft Scheme Aborted 
7 Jewelry (including unset precious and semiprecious stones) 
8 Precious Metals (gold, silver, silverware, platinum, etc) 
9 Art, Antiques or Rare Collections: 
10 Dangerous Drugs 
11 Wespons or Explosives 
12 Businesses or Assets Forfeited 36 All Other Potential Economic Loss Prevented (not falling in any 
20 All Other Recoveries (not falling in any category above) category above} 


*The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this 
report if the recovery is $1 million or more, or if the PELP is $5 million or more. 


Subject Description Codes * 
- Enter Description Code Only When Reporting @ Canviction - 


Organized Crime Subjects: Union Members: 
1A Boss, Underboss or Consigliere SA_ International or National Otficer 
1B Capodecina or Soldier 5B Local Officer 
1C Possible LCN Member or Associate 5C Union Employee 
1D OC Subject Other Than LCN Government Official Or Employees: 
Known Criminals (Other Than OC Members): 6A Federal - Elected Official 
2A Top Ten or 1.0. Fugitive 6B Federal - Nonelected Executive Level 
2B Top Thief 6C Federal - Ail Other 
2C Top Con Man 6D State - Elected Official 
Foreign Nationals: 6E State - Nonelected Executive Level 
3A Legal Alien 6F State - All Other 
3B legal Alien 6G Local - Elected Official 
3C Foreign Official Without Diplomatic Immunity 6H Local - Nonelected Executive Level 
3D U.N. Employee Without Diplomatic Immunity 6J Local - All Other 
3E Foreign Students. Bank Officers Or Employees: 
3F All Others 7A Bank Officer 
Terrorists: 7B Bank Employee 
4A Known Member of a Terrorist Organization All Others: 
48 Possible Terrorist Member or Sympathizer 8A All Other Subjects {not fitting above categories) 


*If a subject can be classified in more than one of the categories, select the most appropriate in the circumstance. 


Instructions: 


Subject Priorities for FBI Arrest or Locates: 

A - Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault} or convicted of such crimes in 
the past five years. 
B - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past 
five years. 

C - Allothers 

Claiming Convictions Other Than Federal: 
It is permissible to claim a local (state, county or local) conviction if the FBI's investigation significantly contributed to the successful local 
prosecution. A succinct narrative setting forth the basis for claiming @ local conviction must accompany this report. When claiming a conviction 
other than Federal, enter the word "LOCAL" in the "Conviction-Section” block, disregard the number of conviction counts, but enter the sentence 
in the appropriate blocks. Enter “LF” in the “In-Jail” block for all life sentences and “CP” for all capital punishment sentences. 

Reporting Convictions: 
Convictions should not be reported until the sentence has been issued. There are two exceptions to this rule. The conviction information can be 
submitted by itself if: 
1. The subject becomes a fugitive after conviction but prior to sentencing 
2. The subject dies after conviction but prior to sentencing. 
An explanation is required in the Remarks section for either of the above exceptions. 

Rute 20 Situations: 
The ‘field office that obtained the process (normally the office of origin) is the office that should claim the conviction, not the office where the 
subject enters the plea in cases involving Rule 20 of the Federal Rules of Criminal Procedures, 

Investigative Assistance or Techniques (lA/Ts) Used: 
-Since more than one IA/T could have contributed to the accomplishment, each IA/T must be rated. 
-The IA/T used must be rated each time an accomplishment is claimed. (For example - if informant information was the basis for a complaint, art 
arrest, a recovery and a conviction and if separate FD-516s are submitted for each of the aforementioned accomplishments, the “informant 


Information” block must be rated on =_ even if it was the same information that contrib; . to all the accomplishments.} 


AX 196A-633 


i subjects: bé 
and BIC 


2* 


PRRs (rev. 9-24-82) @ @ a) 
‘ACCOMPLISHMENT REPORT } 3B 
{Submat within 30%days gom-aGFe of accomponment 5 PA {ga 
“Ne F Cate 


” 
DIRECTOR, FBI Inver 


TO: » ffi 


igo Avsisano or Techniques Une 
EGStaFla Wine} ore ay of ma entgatesasotance or tctiuon fated btw used in connecton wth | 
Ipeing claimed? (] No [] Yes - It Yes, rate each used as follows: 


1 = Used, but did not heip 
FROM: \ {194 n _ 2 = Helped, but only minimany 
SUBJECT; ANDRIA 196A-633 3 = Helped, substantially ['6. Show Money Fating 
Field Ottice Fite Number 4 = Absolutely essential Usage 
WAT N 5 Resig Tech ating] 6, ELSUR- — Raingli?. Lab OW Ratinght7, Survet 
WAT RAME Assistance Titte 1 Field Support ‘Sq Asst 
FBW; CONSPIRACY 3 fa. Ararat 7. Hypnosis 2. Pen 8. SWAT Team 
00: AX Tauad ov RA Nutbor acsiatance Assitance Regeters Acton 
Computer @, Tent Bw 1, Protogrephis 8. Tatephone Tol 
2c Pecterel Agence’ +) | Assistance Assistance Coverage Records 
‘operation. 4. Consensval 9. Informant +4. Polygraph j20. Undercover 
= Kit cage invowves Monitoring ‘ntormation Assistance Operation 
Conupiion of a pubic 7 = reat 
compton ofa public, | TS ELSUR Ro ae ['S. Saaran Warents 27, Visual invest 
local). FISC Exams Executed Analysis (VIA) 
fA. Preliminary Judicial Proceas  |_Compiaints [ intomations [indictments “[p. Recoveries, Reatitutlons, Count Ordered Forteltures or Potentiei Economic Lous Prevanted {PELP) 
{Number of subjects) — 
[propery 0 
[B. Arreste, Locetes, Summons: ‘Subject Priority (See Reverse) ELP TPS) Potential Economic 
44 Subpoonae (Wo. of subjects) x 3 - Code Recoveries Reatitutions Court Ordered Forteitures} _Loas Prevented 
s $s . Is 1s 
FBI Arcosts 
3 5 s s 
FBI Locates - 
$ $ is s 
Number of Subjects of F&I Arrests Who Physically Resisted 
Number of Subiecte of F&I Araats Who Were Armed $ $ s s 
(Criminal Summons — ‘Subpoenas Served $ s is $ 
[C. Ralense of Hostages: (Number of Hostages Retexsed} E. Clvit Matters Government Defandant Government Plaintitt 
Amount of Suit 1S is 
Hostages Held By Terrorists _____: Al Other Hostage Situations 
Settlement or Award $ $ 
Enter AFA Paymont Here 
IF. Finei suctelal Process: vudicial Distict ED (VA (Use two totter state abbreviations per U.S, Post Olfice Guide, For Example - The Horthem District of Texas as ND TX; The 
prict of Maine as ME in the state fiats only.) V 
‘Subject 1 - Name Subject’e Description Code * - bé 
o OD fiction Tevell Tern Buapended Probation bIC 
lon 
Prova = Convictions - ” | tie [Section counts | va | mos | vs | mos | Yrs | moo fine 
Enter convicton and Misde- is 
5) ismisset] | sentenco dnain opaco er [Ol moener} 47 [223 Lab 1 2 8 
acquit! ight. tf more then four i 
{ sections ara involved, (mit to [[) Plea 
: the four moat rotevant, aan 
: 1 teas 
Za / 
ra LIAS / 
~-[ Subject 2 « Name - «_ Subjects Désetption Cpt (7 / 
nD Conviction Jail Tam ‘Suspended BPbation 
Provial = Convictions - 1 Fetony [Fite Seaton Counts | ¥is | Mos | We | Mos | We | Mos/ ‘ne 
o Owersion) | Enter conviction and CO Msce { id 
o Dismissal ‘sentence date In space at meanor ~ 
Acauital | right, tt more than four XY ls 
sections are involved, imi to|C] Plea 
the tour most relevant, Is + 
tae : 
Qo $s 
Subject § - Name Subject’s Description Code ~~ 
Canvletion Trial Term | _ Suspended 
Prati sconvetionn- — |CD. FY Fite ‘Section Counts | _vs_| Mos_| ves | Mos 
Ib Dwersion| | Enter conviction and OD Misco: 
Oramissal sentence data in space at meaner 
1 seautal | fagtt fre than foo / a 
aectons are invotved, tint to| L] Pleo 
9 f 
the four most eiovant CO tea : 
ORS 1984 
Attach additional forms If reperting tinal judiciat procnes on more than three subjects. 


ag 


ed guilty to one count ofS tLe=AL, ae 
before U. S. Magistrate CURTIS SEWELL. is 


Romaree On 5/8/84, subject 
USC, Section 223 (a) qy 
: anal 
a Qo ww 
Cho Go00! 


2 - Field Office (1-196A-633) (1-Statistics In Process) GDF:llv (4) 


* See codes on reverse sida, Subject description codas in Section F ate required only when reporting @ conviction. 


** idanlity tha other Federal Agencyties) In the Remarks Section, RBI/ DOF 


Property Type Codes* Potentlal Economic Loss Prevented (PELP) Type Codes * 
Code Code 
No Description No Description > 
1 Cash (U.S. and foreign currency) 21 Blank Negotiable Instruments or Tickets 2 S 
2 Stock, Bonds or Negotiabie Instruments (checks, travelers checks, 22 Counterfeit Stocks, Bonds, Currency or Negotiable Instrumentst> 
money orders, certificates of deposit, etc) 23 Counterfeit or Pirated Sound Recordings or Motion Pictures 2° 
3 General Retail Merchandise (clothing, focd, liquor, cigarettes, TVs, etc)| 24 Bank Theft Scheme Aborted : Fz] 
4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) 25 Ransom, Extortion or Bribe Demand Aborted 
5 Heavy Machinery & Equipment (heavy equipment, computers, etc) 26 Theft From, or Fraud Against, Goveriment.Scheme Aborted 
6 Bulk Materials (grain, fue!, raw materials, metals, wire, etc) 27 Commercial or Industrial Theft Scheme Aborted ~~” 
7 Jewelry (including unset precious and semiprecious stones} 
8 Precious Metals (gold, silver, silverware, platinum, etc} es 
9 Ast, Antiques or Rare Collections 
10 Dangerous Drugs 
11 Weapons or Explosives 
12 Businesses or Assets Forfeited 30 All Other Potential Economic Loss Prevented (not falling in any 
20 All Other Recoveries (not falling in any category above} category above) 


*The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this 
report if the recovery is $1 million or more, or if the PELP is $5 million or more. 


Subject Description Codes * 
- Enter Description Code Only When Reporting a Conviction - 


Organized Crime Subjects: 
14 Boss, Underboss or Consigliere 
1B Capodecina or Soldier 
1C Possible LCN Member or Assdciate 
4D OG Subject Other Than LCN 


Union Members: : 
5A International or National Officer 
5B Local Officer ‘ 
5C Union Employee 

Government Official Or Employees: 


Known Criminals (Other Than OC Members): 6A - Federal - Elected Official 
2A Top Ten or |.O. Fugitive 6B Federal - Nonelected Executive Level a 
28 Top Thief 6C Federal - All Other : 
2C Top Con Man 6D State - Elected Official 
Foreign Nationals: 6E State - Nonelected Executive Level 
3A Legal Alien 6F State - All Other 
3B Ibegal Alien 6G Local - Elected Official 
3C_ Foreign Official Without Diplomatic Immunity 6H Local - Nonelected Executive Level 
3D U.N. Employee Without Diplomatic Immunity 6J Local - All Other 
3E Foreign Students Bank Officers Or Employees: 
3F All Others 7A Bank Officer 
Terrorists: 7B Bank Employee 


4A Known Member of a Terrorist Organization 
486 Possible Terrorist Member or Sympathizer 


Ail Others: 
8A All Other Subjects (not fitting above categories) 


“If a subject can be classified in more than one of the categories, select the most appropriate in-the circumstance. 


Instructions 


Subject Priorities for FBI Arrest or Locates: 


A - Subject wanted for crimes of violence (i.e. murder, manstaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in 


the past five years. 


B - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past 


five years. 
Cc - Allothers 
Clalming Convictions Other Than Federal: 


Itis permissible to claim a local (state, county or local) conviction if the FBI's investigation significantly contributed to the successful local 


prosecution. A succinct narrative setting forth the basis for claiming a local conviction must accompany this report. When claiming a conviction 
other than Federal, enter the word “LOCAL” in the ‘Conviction-Section” block, disregard the number of conviction counts, but enter the sentence 
in the appropriate blocks. Enter “LF” in the “In-Jail” block for all life sentences and “CP” for all capital punishment sentences. 

Reporting Convictions: 
Convictions should net be reported until the sentence has been issued. There are two exceptions to this rule. The conviction information can be 
submitted by itself if: 
1, The subject becomes a fugitive after conviction but prior to sentencing. 
2. The subject dies after conviction but prior to sentencing, 
An explanation is required in the Remarks section for either of the above exceptions. 

Rule 20 Situations: 
The field office that obtained the process (normally the office of origin) is the office that should claim the conviction, not the office where the 
subject enters the plea in cases involving Rule 20 of the Federal Rules of Criminal Procedures. 

Investigative Assistance or Techniques (IA/Ts) Used: i 
“Since more than one {A/T could have contributed to the accomplishment, each (A/T must be rated. 
-The IA/T used must be rated each time an accomplishment is claimed. (For example - if informant information was the basis for a complaint, an 
arrest, a recovery and a conviction and if separate FD-518s are submitted for each of the aforementioned accomplishments, the “Informant 
Information” block must be rated on each FD-515 even if it was the same information that contributed to ail the accomplishments.) 


RR 


DE 
RR 19 18582 LAJULTY 84 
FM ALEXANDRI'Q C1S96A-§35) (P) 


TO DIRECTOR ROUTINE 
¥ 


BT / 
WAI NE ane) FRM, OO: AX . . Oe 
RE ALEXANDRIA TELETYPE TO THE BUREAU, JUNE 14, 1984, [ 


ON JULY 12, 190 re SS SENTENCED BY JUDGE JANES ne 


C. CACHERIS, EASTERN DISTRICT OF VIRGINIA, ALEXANDRIA, VA., ON b7c 
TWO COUNTS OF VIOLATION OF TITLE 18, usc 1343.[ was 
SENTENCED TO ONE (1) YEAR SUPERVISED PROBATION ON BOTH COUNTS 


TO RUN CONCURRENTLY. HE WAS ALSO ORDERED TO MAKE RESTITUTION 


IN THE AMOUNT OF $225.17. 
BT 


b6 


| 13 SEP 05 1984 | —_ | 6 bre 


FD-516 (Rev. 9-24-82) 
ACCOMPLISHMENT REPORT 4 


(Submit pittin 30 days trom date of accomplishment) 


7/24/84 


Data 
£6: DIRECTOR; FBI Inventigetive Assistance or Techniques Ug 7 
a Sey 
Bureau File Number Ware any of the investigative essistance or tachniques listed betow usd in connection with accomplishment} 
being cisimes? [] No 13 - if Yas, rate each used as follows: 
. 1 = Used, but did not help 
FROM: sat> XANDRIA (P) 196A-633 2 = Helped, but only minimally 
SUBJECT: 2 = Helped, substantiaty fie. Show Moneg | 
- cS Field Office File Number 4 = Absolutely essential Usage 
cs FT Resig Tech @, EUR: Vt. tab Ow | AF. Survet 
CMAT NFRAI Assistance Title Fialé Support| Sas Asst 
FEW 2 Arora 7 Fivonosis hz, Pen ja, SWAT Team 
Sauad of RA Number ‘stance 
(00: AX a Assistance Assistane: Registers Action 
Oo IS. Computer @. ent OW RS” Photographs 8, Telephone T 
= Xif a joint FBKDEA (or 
Sinot Pedera) apenas Assistance Assiatance Coverage Records TE 
operation. |4. Consensue! 9. informant 14. Polygraph RO. Undercover 
C1 xi case invotves Monitoring information Assistance Operation 
compton af & pubic 
caruption ola pute | 5 ELSUR ho. tab OW 5. Search Wer Pay, Visual Inv 
toca, FIs Exams Executed Analysis ( 
|A. Pretiminery Judictal Process Compiaints {ncictments Ip, Aecovaries, Restitutions, Court Ordered ForteHures or Patentiat Economic Loss Prevented (PELP) 
(Number of subjects) — —— 
[Property of 
8. Arrests, Locates, Summonse: Subject Prorty (See Reverse} eLP Type] Potential Economic 
2 Subpoenas (No, of subjects) x - = ode Recoveries Rostiutons [Coun Ordered Forteitures| __Loae Prevented 
$ $225.17 ls s 
FBI Arrests - 
s s is S$ 
FI Locates - 
$ $ is $ 
Number of Subjects of FBI Areats Who Physically Resisted, 
Number of Subjecte of FSi Arrests Who Were Armed $ $ s s 
Criminal Symmons, Sudpoenes Served $e $ s $ 
IC. Release of Hostages: (Number of Hostages Released) E. Civil Mattore Government Defendant Government Ptalntitt 
Amount of Suit Ss 3 
Hostages Held By Terrorists All Otnar Hostage Situatons : 
‘Sattiement of Award s s 
Entor AFA Payment Hore 
F. Finai Judicial Procer Judicial District ED VA {Use two later state abbreviations par U.S. Post Office Guide. For Example The Northom Disbict of Texas as ND TX: The | 
jabict State Dlstict of Meine as ME in the elate fold only.) Cc | * 
‘Subject 1 - Name. 
BIC 
Conviction Tadall Tara Suspended 
GD Preteiat Fetony bIE 
Oiversro + Convictions: Title Section Counts, Yes Mos Yes Mos Fine 
ive mn Enter Conviction and ‘Misde- y 
FD dionisal |semnce cen erecoat (Cl ewer f 28 | 1343 2 1 Aa} 
A acquitet) —|etght. tt enore than tout i f Y fo 
sections ste involes, it to aed 
the four most relevant. Is 
wa 
is 
Subject 2 - Name ‘Subject'e Description Cod 
Convlotion Tall Tenn | Suspended Probation 
Fees Ce ele ere ee roo 
version 
Enter comvicton and Migde- is 
asm} | costonoe detain space att |) neon 
TO rcauittas right. lf mare than four Is 
sections are involved, timi to] Plea 
the tour most relevant, 0 “ee Ae As aS ( 
Tot rag 
CAS Lue pf. Le fs 
aaa = 
Subject 3 - Nama 7 subject's Descriptor Code * - 
Conviction inndalt Term | Suopended Probation 
0 Pretit <convietions- [LD F#PY Tite ‘Section Couns | vro_| mos | vis | Mos | vis | Mos Fine 
ivarsion 
Enter conviction and Made ; 
IC) ismissat] | sentence data in space at meanor| . 
2 _scuitt | front more man tour ‘ 
gectons ar invtved it to Plea boss a 
6 four most relavan 
That 
ial ifs 
ge JUL 26 984 
‘Attach additfonat forma If reporting tinal judiclel process on morgyéfen threa bubjects. 
Romans ae — a 
° = 
a aw 


Que (1-196A-633) 
* Soe codes on roveoe sie 


++ Identify the other Federal Agency{ies) in the Remarks Section. 


{1-Statistics in Proces 
Subject description codes In Section F ato required only when reporting a convicton. 


Ss) PIN:kar (4) 


Nee 


Property Type Codes* Potentlal Economic Loss Prevented {PELP) Type Codes * 


Code , Code 

No Description ‘ No Description 

1 Cash (U.S. and foreign currency) 21° Blank Negotiable Instruments or Tickets 
Stock, Bonds or Negotiable Instruments (checks, travelers checks, 22 Counterfeit Stocks, Bonds, Currency or Negotiable instruments 
money orders, certificates of deposit, etc) 23 Counterfeit or Pirated Sound Recordings or Motion Pictures =," 

3 General Retail Merchandise (clathing, food, liquor, cigarettes, TVs, etc)}_ 24 Bank Theft Scheme Aborted 

4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) 25 Ransom, Extortion or Bribe Demand Aborted 

5 Heavy Machinery & Equipment (heavy equipment, computers, etc) 26 Theft From, or Fraud Against, Government Scheme Aborted 

6 — Bulk Materials (grain, fuel, raw materials, metals, wire, etc) 27 Commercial or-Industrial Theft Scheme Aborted 

7 Jewelry (including unset precious and semiprecious stones) eos 

8 — Precious Metals (gold, silver, silverware, platinum, etc) 


9 Art, Antiques or Rare Collections 
10 Dangerous Drugs 

11 Weapons or Explosives 

12 Businesses or Assets Forfeited 30 All Other Potential Economic Loss Prevented (not falling in any 
20 All Other Recoveries {not falling in any category above) category above) 


* The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this 
report if the recovery is $1 million oF more, or if the PELP is $5 million or more. * 


Subject Description Codes * 
- Enter Description Code Only When Reporting a Conviction - 


Organized Crime Subjects: Union Members: . 
1A Boss, Underboss or Consigliere 5A_ Intemational or National Officer 
1B Capodecina or Saldier 6B Local Officer 
1€ Possible LCN Member or Associate 5C Union Employee 
1D OC Subject Other Than LCN Government Official Or Employes 
Known Criminals (Other Than OC Mambers): 6A Federal - Elected Official 
2A Top Ten or 1.0. Fugitive 6B Federal - Nonelected Executive Level 
2B Top Thief 6C Federal - All Other 
2C Top Con Man 6D State - Elected Official 
Forelgn Nationals: 6E State - Nonelacted Executive Level 
3A Legal Alien 6F State - All Other 
3B illegal Alien 6G Local - Elected Official 
3G Foreign Official Without Diplomatic Immunity 6H Local - Nonelected Executive Level 
3D U.N. Employee Without Diplomatic Immunity 6J Local - All Other 
3E (Foreign Students Bank Officers Or Employer 
3F All Others 7A Bank Officer 
Terrorists: 7B Bank Employee 
4A Known Member of a Terrorist Organization Ail Others: 
4B Possible Terrorist Member or Sympathizer 8A All Other Subjects (not fitting above categories) 


"ia subject can be classified in more than one of the categories, select the most appropriate in the circumstance. 


Instructions 


Subject Priorities for FB! Arrest or Locates: 

A - Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in 
the past five years. 
8 - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past 
five years. 

C - Allothers 

Claiming Convictions Other Than Fedorai: 
(tis permissible to claim a local {state, county or local) conviction if the FBI's investigation significantly contributed to the successful local 
prosecution. A succinct narrative setting forth the basis for claiming a local conviction must accompany this report. When claiming a conviction 
other than Federal, enter the word "LOCAL" in the “Conviction-Section” block, disregard the number of conviction counts, but‘enter the sentence 
in the appropriate blocks. Enter “LF” in the "In-Jail" block for all fe sentences and “CP” for all capital punishment sentences.” 

Reporting Convictions: 
Convictions should not be reported until the sentence has been issued, There are two exceptions to this rule. The conviction information can be 
submitted by itself it: 
1. The subject becomes a fugitive after conviction but prior to sentencing 
2. The subject dies after conviction but prior to sentencing. 
An explanation is required in the Remarks section for either of the above exceptions. 

Rule 20 Situations: : 
The field office that obtained the process (normally the office of origin) is the office that should claim the conviction, not the office where the 
subject enters the plea in cases involving Rule 20 of the Federat Rules of Criminal Procedures. 

Investigative Assistance or Techniques (IA/Ts) Used: 
-Since more than one IA/T could have contributed to the accomplishment, each IA/T must be rated. 
-The (A/T used must be rated each time an accomplishment is claimed. (For example - if informant information was the tSlis for a complaint, an 
arrest, a recovery and a conviction and if separate FD-515s are submitted for each of the aforementioned accomplishments, the “Informant 
Information” block must be rated on each FD-516 even if it was the same information that contributed to all the accomplishment 
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Ag 


Date 


DIRECTOR, FBI Investigative Aveistance or Techniqued Used 


Bureau Fig Number | [Were any ofthe investigative assiatance or techniques Isted below used in connection with accomplishment 
feeing claimed? [] No 8] Yes - It Yes, cate each used as toliows: 
*. + = Used, but did net hetp: 
(P) | 196A-633 2 = Helped, but onty minimay 
3 = Hobed, substantially 
Field Office Fie Number 4 = Aneokioty eazontal 
fT Rat Tec 3. ELSUR i, tab Gv 
2 Assistance Title m Field Suppon| 
OO: AX 2, Arora 7, Hypnodia he Fon 
( ) Squad or RA Number Assistance Assistance Registers 


Computer @, Went Ow 13. Photographic 


LD - x ita joint FRVDEA tor ID7E 


Xi aypiat FBUDEA tor. |" assiotance Assistance Covernge 
operation. Is, Consensual @ informant rs. Paiyaraph Undercover 
OO - xitcase tones Monitoring information Assistance Operation 
comuption of a public 3 
officiat (Federal, State or 5. ELSUR 10. Lab DF ['5. Search Wan 
feed FIsc Exams Executed 
[A. Protiminary Judicial Procesr Complaints [_Taformatione [Indictments Tp, Recoveries, Reatilutions, Court Ordered Forfeltures or Potential Economic Loes Prevented (PELP) 
(Number of subjects) — — 
leropery of Py : 
IB. Arrests, Locates, Summonses ‘Subject Priority (See Reverser PELP Type} Vf SF Jaf. Potential Economic 
& Subpoonas No. of subjecta) x z 5 Code Recoveries Restiutions it Oraeded Fortéfutes |? Losa Prevented 
3 $ s 3 
FBI Arrests - 34.00 
~ $ $ Is $s 
FEI Locetes 
$ $ Is $ 
Number of Subjects of FBI Arrests Who Physicaly Resisted 
Number of Subjects of FBI Arrests Wo Were Armed 8 $ s s 
Criminal Summons. ‘Subpoenas Served ___ s $ is $ 
|e__Belee of Hostages: (Number of Hostages Released) ©. Civil Matters Government Defendant Government Plaintit 
ra Amount of Suit $ id 
“IZ Fostdges Held By Terrorists ____; A Other Hostage Sitvations 
~~ ms) Settlement or Award $ $ 
Enter ARA’Raymant Here 
F. Fine! Judicial Process: Judicial District SQeacee TOWA (Use two totter state abbreviations per U.S. Post Olfice Guide, For Example - The Northem Oiswict of seston 
‘Subject 3 - Name A 
<2 __b7C 
a Canvietion ede Tem 
Dre “una Te ee eee i BIE 
version! | Enter conviction and Mise 22 5 
[D aanasa] femore ianeonce ot Sl meme 47 | 223 
A scquitat| | ight. tt more tan tour ‘| s 
sections are invoWved, int to|f*) Plea 
the tour most relevent Hh s 
[Ota 
VA fe 
Subject 2 - Nene Subject's Deteription Cod 
Conviction Todell Term Suapanded Probation 
version ~ 
Enter conviction and Misde- 69 Co 
J emssal} | sentence atin seco st OF eener 
Acauitial | | right. If more than tour a ffs 
sechons are involved, limit to] Flea > rary 
ZO aha 
the four most rotvant BSpSeK BU BG 
O tia 
1s 
‘Subject 3 - Name ‘Subject’s Gescription Code 
Convlation inedall Term Suapendod Probation 
[3 Pretit =convietions» OI F°Y Figo Section Counts | ¥ro_| Mos | vs | mos | vm | Mos 
Burren | enter comvcion ana [ Msde- ; 
Dismissal sentence data in space at meanor 
recuitat | frgnt ore than for : 
sections are involved, mit to| CP Plea 3 
he four 
the four moat relevant, Ota 
5 kd 
Attach additional forma i reporting fins) judicia! process on more than threes subjects. 


Remarks 
4 ; . 
Aron one: (1 196A-633) (1-Statistics in Process) PIN:kar 
* See cadas on reverse side, Subject description codes in Section F are required only when reporting a conviction, (2) 


"+ Identity the other Federal Agency(ies) in the Remarks Section. FBI/DOJ 


Property Type Cod Potential Economic Loss Prevanted (PELP) Type Codes * 
Code Code 
No Deseription No Description 
v4 Cash (U.S. and foreign currency) 21 Blank Negotiable Instruments or Tickets 
2 Stock, Bonds or Negotiable Instruments (checks, travelers checks, 22 Counterfeit Stocks, Bonds, Currency or Negotiable Instruments 
money arders, certificates of deposit, etc) 23 Counterfeit or Pirated Sound Recordings or Motion Pictures 
3 General Retail Merchandise (clothing, food, liquor, cigarettes, TVs, etc}| 24 Bank Theft Scheme Aborted 
4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) 25 Ransom, Extortion or Bribe Demand Aborted 
5 — Heavy Machinery & Equipment (heavy equipment, computers, etc) 26 Theft From, or Fraud Against, Government Scheme Aborted 
6 Bulk Materials (grain, fuel, raw materials, metals, wire, etc) 27 Commercial or Industrial Theft Scheme Aborted 
7 Jewelry (including unset precious and semiprecious stones) 
8 Precious Metals (gold, silver, silverware, platinum, etc) 
9 Art, Antiques or Rare Collections 
10 Dangerous Drugs 
41 Weapons or Explosives 
12 Businesses or Assets Forfeited 30 All Other Potential Economic Loss Prevented (not falling in any 
20 All Other Recoveries (not falling in any category above} category above) 


“The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this. 
report if he recovery is $1 million or more, or if the PELP is $5 million or more. 


Subject Description Codes * 
- Enter Description Code Only When Reporting a Conviction - 


Organized Crime Subjects: Union Members: 
1A Boss, Underboss or Consigliere 5A_ International or National Officer 
1B Capodecina or Soldier 5B Local Officer 
1C Possible LCN Member or Asscciate SC Union Employee 
1D OC Subject Other Than LCN Government Official Or Employees: 
Known Criminals (Other Than OG Members): 6A Federal - Elected Otticial 
2A Top Ten ar 1.0. Fugitive 6B_ Federal - Nonelected Executive Level 
2B. Top Thiet : 6C Federal - All Other 
2C Top Gon Man 6D State - Elected Official 
Foreign Nationals: 6E_ State - Nonelected Executive Level 
3A Legal Alien 6F State - All Other 
3B legal Alien 6G Local - Elected Official 
3C_ Foraign Official Without Diplomatic Immunity 6H Local - Nonelected Executive Level 
3D U.N. Employee Without’ Diplomatic immunity 6J Local - All Other 
3E Foreign Students ~ Bank Officers Or Employees: 
3F All Others 7A Bank Officer 
Terrorlats: 7B Bank Employee 
4A Known Member of a Terrorist Organization All Others: 
4B Possible Terrorist Member or Sympathizer 8A All Other Subjects (not fitting above categories) 


“(fa subject can be classified in more than one of the categories, select the most.appropriate in the circumstance. 


instructions 


Subject Priorities for FEI Arrest or Locates: 

‘A. - Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in 
the past five years. 
B - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past 
five years. . 

GC -zAll others 

Claiming Convictions Other Than Federal: 
it is permissible to claim a local (state, county or local) conviction if the FBI's investigation significantly contributed to the successtul local 
prosecution. A succinct narrative setting forth the basis for claiming a local conviction must accompany this report. When claiming a conviction 
other than Federal, enter the word “LOGAL" in the “Conviction-Section” block, disregard the number of conviction counts, but enter the sentence 
in the appropriate blocks. Enter “LF” in the “In-Jaii” block for alf life sentences and “CP” for all capital punishment sentences. 

Reporting Convictions: 
Convictions should not be reported until the sentence has been issued. There are two exceptions to this rule. The conviction information can be 
submitted by itself if: 
1. The subject becomes a fugitive after conviction but prior to sentencing. 
2. The subject dies after conviction but prior to sentencing. 
An explanation is required in the Remarks section for either of the above exceptions 

Rule 20 Situations: 

The. field offigg*that obtained the process (normally the office of origin) is the office that should claim the conviction, not the otfice where the 

J subject § the plea in cases involving Rule 20 of the Federal Rules of Criminal Procedures. 

investigate bg Istance or Techniques (lA/Ts} Used: 

-Since méré;fhan one A/T could have contributed to the accomplishment, each IA/T must be rated. 

-The IA/T u8éilinust be rated each time an accomplishment is claimed. (For example - if informant information was the basis for a complaint, an 

arrest, a recovery and a conviction and if separate FD-515s are submitted for each of the aforementioned accomplishments, the “informant 

Information” block must be rated on each FO-515 even if it was the same information that contributed to all the accomplis iments.) 


® so 
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Date 


430/84 


(Submit within 30 days from date of accomplishment) 


investigative Assistance or Technique Used 
TO: DIRECTOR, FBI i 
‘ . Bureau Fe iomber ' 
; [Sens net || vere yo te ostatyggnesenco or ectiues sts below usd comscton wih accnsisnars g 
being climes? LI no LF Yes. it Yes, rate each used as folows: 
FROM ALEXANDRIA (P) 196A-633 =| /""" 1 = Used, but did not help bic 
SUBJECT: Fisid Office File Number 2 = Helped, but only minimally bIE 
— | @ = Helped, eubstantialy 
2 4 = Absolutely essentia! 16. Show Money 
[Squad of ha Namber Usage 
! 1. Reig Tech = ELSA 11 Lab. OW 17. Surved 
Asstance Tio Field Suppor Sau Asst 
- a a 7. Hypnosis 1, Pen 16. SWAT Tear 
Agent's Social Security No. Assistance Assistance Registers Action 
TI xita point operation with [3 ‘Computer @. Ident Diy 13. Photographic 19, Telephone Tol 
aroter Federal Sate of | assistance L _aAsspstarce Coverage Records 
‘ocal LE agency . 
Cxreas oes 4” Consensual 2. (nvgimade 74, Polygraph 20, Undercover 
i case involve! 
Xitcaue inves Monitoring igfgrmation Assistonce Operation 
official (Federal, State or | 5- ELSUR- 1 OF Lab Div 1S, Search Wareal 21, Visual Invest -| 
: Loca, Fist Ems Executed Analysis (VIA) 
A. Preliminary Judicial Process Cormplainis | Wlermations | Indicinents [O, Recoveries, Resiiutlone, Court Ordeved Foraliures or Potentiai Economic Loas Prevented (PELP) 
{Number of subjects) Property or 
PELP Type Potential Econamic: 
. | eayiene testes womomr susie PiSiny (60 Fras Code Recoveries Restiutons _|Covit Ordered Fortatures| Loss Prevented 
Subpoenes (No, of subjecto) z 7 t 5 s $ $ 
£61 arrests ; ; : ; 
. Fal Locates - 
— - $ $ $ & 
Number of Subjects of FBI Artests Who Physicaly Resisted 
$ s $ $ 
Number of Subjects of FAI Arrests Who Were Armed #4 
Criminal Summons Subpoenas Served 5 3 $ 3 
[C. Release of Hostages or Chitdran Located: (Number of Hostages or Chiléran | E. Civil Matters ~ ‘Govemment Defendant ‘Govemment Plaintit 
Lacated) : 
$ s 
Hostages Held By Terronsts Asount of Suit 
6 & 
Missing or Kidnapped Children Located | settomant or Award emer c=N 
“= [FFinat Judicial Process: Judicial District 9/17/84 3 


Dates 


Camvictions (or Final Judicial Process) Date 


ND | IL 


subject 1 - Name 
Crea] “Convicons = Fury 7 Conviction ~ Combined Sentence tor 7 bie 
Diversion Enter conviction and Title Section Counts In-Jalt Term ‘Suspended Probation 
Cloamicss’ | lsemerce sae msnece ot |] wiede we [wes Lye] mee] hres 
Oat | ot tremor [— "| 1g [1343 1! g ° 
= AONE YH | sections are involved, timit to |] pea 
ths lor mou relevan Seabeoaive Sentences Fad a conseeuus werTanos Waser 
———_+ 
Do notrepor contin | C) toa Goncarrent Sentences - Ener ongeal angle tem. De not ad eoncurent sentences legates 
unst sentence es been ithe sentences 10 yess m cutesy ofthe Atty Gan, But8 years ate suspended the 
pronaureed Inval tm would be 2 years 
‘Subject 2 - Name - 7 ‘Subject’s Description Gode*- 
© Peetria 7 Coniationa: TD Feony ‘Conviction ‘Sonitined Sentence > 
Diversion | | Enter conviction and Tie Section ‘Counts To-dail Term Suspended ~ Probation 
Di domssa) | [sentence dntein space at | I msde - Ws [Mes We] Wes] ee Tela Fes 
. | [Rn irmove man tor Lv 
{D2 Accum | | S&ons we woes bit © |) ae i 5 - 
the tour est rebar Gecatve Soioroes “ha a conecetns sentences poor 
Do not report conviction | [7] trial Concurrent Sentences - Eater longest single term. Do not add concurrent sentences together, 
vntl sentence nas been | . i tho sentanee's 10 yeate in custosy of ne Aty Gen bul 6 years are suspencoe, he 
pronounces tnt etn woul be 2 yours 
pee ‘37 Name- 7 ‘Subjects Oescription Code™ ~ 
Tipo) 2 Sancton TET romp Teneo Combined Sentence 
Drain | { Entercomicion ang Tis [___ section [Couns] [Toa tare [_— siepandea Probation 
© Semeeal | [sentence catan space ot | isda Ye] wos Ve |, Mee] fg Nae 
cau tight, ff mare than four 7 7 7 7 
{2 sceuina_} |oRtons ave eave wrt © UE] ppg . i) ty Tey yf td 
the four most relevant, i _ Consecutive Sentences - Add all consecutive sentences together, 
Op not seport conviction |] tat Concurrent Sentences - Enter longest single term. Oo not add canourrent sentences together. 
| una sentence has been tine senlonee 10 years cuslony ok ne Aly. Gon bu years ag pugs. The 
pronounced tnval term woul be 2 yrs ed 
[Attach adaitional forms 1 reporting Sinal judicial process on more than three subjecte, and submit a final disposition form (#04) for each subject] ‘To NOV 2 1984 


Remarks: 


@ 4AL 15 1985 


“ogee (A ~19§A-633) (1-Statistics in Process) 
“n geverde cde. Subject descrintion odes in Section F are ‘eguked only whon reDoring a comucton 
dently the other Federal, State or Local Law Enforcement {LE) agency in the Remarks Section, 


Pref 


? dan _ 


FB/D03 


B Property Type Codes" 


‘ 


Code, 
No ‘Description 


Cash (U.S. and foreign currency) 

Stock, Bonds or Negotiable Instruments (checks, travelers checks, 
money orders, certificates of deposit, etc) 

General Retai Merchandise (clothing, food, liquor, cigarettes, TVs, etc) 
Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc} 
Heavy Machinery & Equipment (heavy equipment, computers, etc} 
Bulk Materials (grain, fuel, raw materials, metals, wire, etc) 

Jewelry (including unset precious and semiprecious stones) 

Precious Metals (gold, silver, silverware, platinum, etc) 

Art, Antiques or Rare Collections 
Dafigerous Drugs 

Weapons or Explosives 
Businesses or Assets Forteited 
All Other Recoveries (not falling in any category above) 


Code 
No 


22 
23 
24 
25 
26 
27 


30 


a 4 


Description 


Counterfeit Stocks, Bonds, Currency or Negotiable wat hens f 
Counterfeit or Pirated Sound Recordings or Motion Pictures 

Bank Theft Scheme Aborted I 
Ransom, Extortion or Bribe Demand Aborted . 
Theft from, or Fraud Against, Government Scheme Aborted 
Commercial or Industrial Theft Scheme Aborted 


x 
All Other Potential Economic Loss Prevented (not falling in any 
category above) 


*The case file must contain an explanation of the computation of the recovery value of loss prevented. An explanation airtel must accompany this 
report it the recovery is $1 million or more, or if the PELP is $5 million or more. 


Organized Crime Subjects: 


Known Criminals (Other Than OC Members): 


Subject Description Codes* 
- Enter Description Code Only When Reporting a Conviction - 


1A Boss, Underboss or Consigliere 
1B Capodecina or Soldier _ 

1 Possible LCN Member of Associate 
1D OC Subject Other Than LCN 


22 Top Ten or 1.0. Fugitive 
2B Top Thiet 
20 Top Con Man 


6B U.S. Senator 


Foreign Nationals: 6D Judge 
3A Legal Alien GE Prosecutor 
3B flegal Alien 


3C Foreign Citiciat Without Diplomatic Immunity 


Union Members: 


SA International or National Officer 
5B Local Officer 
5C Union Employee 


6C U.S. Representative 


6F Law Enforcement Officer 
6G Fed Exec - GS 13 & above 6Q All Others - 


Government Officials Or Employees: 
Federal 
6A Presidential Appointee 


Local 
@R Mayor 


State 
8J Governor 
6K Lt. Governor 
6L Legislator 
6M Judge 
8N Prosecutor 
8P Law Enforcement Ofticer 
State 


6S Legislator 

6T Judge 

6U Prosecutor 

&V Law Enforcement Officer 
6W Ail Others - Local 


~~ # 3D U.N, Employee Without Diplomatic immunity 6H Fed Empl - GS 12 & below 
3E Foreign Students Bank Officers or Employees: 
3 All Others 7A Bank Otticer 
Terrorists: . 78 Bank Employee 
4A Known Member of a Terrorist Organization All Others: 


4B Possible Terrorist Member or Sympathizer 


BA Al 


It Other Subjects {not fitting above categories) 


“If a subject can be classified in more than one of the categories, select the most appropriate in the circumstance. 


instructions 


Subject Priorities for FBI Arrest or Locates: 
A- Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in the past five 


years. 


8 - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 of convicted of such crimes in the past five years. 


C- Allothers 


Claiming Convictions Other Than Federal: 
It is permissible to claim a local (state, county or local) conviction if the FBI's investigation significantly contributed to the successful tocal prosecution. A 


succinct narrative setting forth the basis tor claiming 4 local conviction must accompany this report. 


When claiming @ conviction other than Féderal, enter the 


word “LOCAL” in the Conviction-Section" block, disregard the number of conviction counts, but enter the sentence in the appropriate blocks. Enter “LF” in 
the “In-Jail” block for all life sentences and “CP” for all capital punishment sentences 

Reporting Convictions: 
Convictions should not be reported until the sentence has been issued. There are two exceptions to this rule. The convictioi information can be submitted 


by itself if 
1. The subject becomes a fugitive after conviction but prior to sentencing. 
2. The subject dies after conviction but prior to sentencing 


An explanation is required in the Remarks section for either of the above exceptions 


Rule 20 Situations: 
The field office that obtained the process (normally the office of origin) is the office that should claim the conviction, not the oftice where the subject enters the 


plea in cases involving Rule 20 of the Federal Rules of Criminal Procedures. 


Investigative Assistance or Techniques {IA/Ts) Used: 
-Since more than one IA/T could have contributed fo the accomplishment, each iA/T must be rated, 


-The IA/T used must be rated each time an accomplishment is claimed. 


(For example - 


a 


if informant information was the basis 171 a complaint, an arrest, a 


recovery and a conviction and if separate FD-51§s are submitted for each of the aforementioned accomplishments, the “Informant Information” block must be 


rated on each FD-515 even if it was the same - that contributed to all the accomplishments.) 


FD-515 (Rev. 2-27-84) 
ACCOMPLISHMENT REPORT (Effective 10/1/84)! vate 12/21/84 


{Submit wn 20 days rom date of accomptahment - 
{- Tovesligatve Assisonce o Technique Used 


a «: | 
[BaF aT | ae ry oe ning tne inn ae ta cmon win Stanley 
peng calmed?” L] No Lik Yea ives. rate cach vad as folows 
(P) | 196A-633 1 = Used, but did not help BIC 
Fal ise 2 = Helped, bt only nay bIE 
2 = Helped, substantially 


16, Show Money 


2 4 


Absolutely essential 


‘Squad or RA Number rue 5 eee 
. 1 Recta Teoh : 17 Lab. Div 17, Suvel 
(00: AX) oe ‘ee Pvc | cen 
“ . 2. Alrcraft 7. Hypnosis 12. Pen 18, SWAT Team 
f ents Sock! Seeury Ne. | |” assistance Assistance Registers Acton 
/ Ti kita jos operation win 1S"Gomputer @- dent DW 73. Protogrash 73. Telephone To 
aroter Federal State or | Assitancs Aasistance Coverage oro 
cal LE agenc; L. ne 
im] gency 4. Consensual 9. Informant 14, Polygraph indercovs 
X if case involves Monitoring Information Assistance 
Corruption of a public 
Offcil (Federal State or [5 ELSUR 10. Lab Dv 15. Search Wa 21 Misual ties 
Local. rise exams Executed AnalysV 
[A Pretiminary Judicial Process ‘Complaints | Informations | indictments [D. Recoveries, Rostitutions, Gourl Ordered Forfeitures or Potential Economic Loss Prevented (PELF) 
(Number of subjecta) Property or 
PELP Type Potential Economic. 
[awit iaaas Same Sapa Sony Reo Kowanay Code Recoveries Restiutions __[Gauit Ordered Forfetures| Loss Prevented . 
Subpoonas (Na. of subjects) a a {© s s $ $ 
FOI Arrests 3 3 5 “Ts 
FBI Locates - 
~ $ s $ $ 
Number of Subjects of FAI Arrasts Who Physicaly Resisled - . 
$ s $ 8 
Number of Subjects of FBI Arrests Who Were Avmed 
[Criminal Summons Subpoenas Served $ $ 3 $ 
{C- Ratease of Hostages or Children Located: {Number of Hosteges or Children _|E, Civil Matters ~ Government Defendant Government Plain i 
Located} 1 
' $ & 
Hostages Held By Terrorists : All Other Hostage Sitvations | Amount of Sut 
| $ $ 
issing or : award 
Missing or Kidnapped Children Located Settlement or Awar Ealer AFA Payment Here 
F. Final Judicial Praceas: Judicial District ~ 
—.ED | VA_ Dates —. <. - 
Convislions (or Final Judicial Process) Dato Sentence Bale b6 
Subject 1 Name - We Yjporc) 
Drea Tomiehons: ony Conviction Combined Sentence b7E 
Diversion {| | Enter conviction and Tite |< Section ‘Counts inJail Term ‘Suspended Protation | 
Ci dismissal | |senience datain space at | [1 misde- * "ye Mos_|_vrs_ | Mos Yrs Mos Total Fines 
Co aceanat | {20h itmere nan tow 1s | 1343 1 an 5 
ARH | sections ae invowved, tit 0 TFT pea | 1 _ 
the four most relevant | . _ Gansesutive Sentences - Add all Consecutive sentences together 
Do not report convieton |) triat Concurrent Sentences - Enles longest single term. Oo not add concurrent sentences together. 
unti sentence has been _ - ifthe sentence is 10 years in custody of the Atty Gen, bul 8 years ere suspended, the 
{Pronounces. in-uail term would be 2 years 
~ 1 - - - 
‘Subject 2 - Name ~ ~ ~ 7 ~ ~ ~ _ ~ ~ ‘Subjects Ceseription Code* ~ 
al ~Gonvieion- |) reroay tonvieon 7 _ Combined Senience 7 
Diversion Enter conviction and Title ‘Section T ‘Counts redall Teron Suspended Probation 
CU emsea | |sonerce data m space at | CT eae: + Ys [7 Mos [Vis | wos! Wo [os Tota Fives 
DD acquit fight. Hf more than four - i — — 
7 Acauital | | sections are ivaived, tit t9 |) peg | Po - ; - fp L - 
the four most relevant. : _| [Consecutive Sentences — Add al pgnsceuive sontenogs togemner. ; 
Do nat report conviction | [Concurrent Sentencas - Enter géhgpst single term, id poggayront sentepoes jogeth 
stonounced | JInvall term would be 2 ve (is) 
L. : ~ - = = _ 
Subiect 5 Name ‘Subjects Description Codes 7 
1 Pretan “Convene: Ti Feeny | “Gonweton — ~ carb Sronea ~ 
Diversion | | Enter conection and Title Section Counts | [tenia term Suspended 2 Prebetonn hon 
C oismissa! | sentence aatain space at | CT aicde- — ~ ~ Yes [Mos [ves Mos| vis “| Mos 1SG5 tows Fines 
he Fight, tt more than four __!| ~ 7 ; — 
[Eh seater | /28ans we nvowed. timo IE} ppg [ if _ _ 
the four mast relovant. Gonscoutive Sentences Add al consecUive seniences:togethe, 2 
Bo aot report convietion (1) triat Goncurent Sentences - Enter longest single term. Do not add concurrent sentences together 
unt! sentence has been Z W the sentence is 10 years in custody of the Atty Gen, but 8 years are Suspended. the 
pronaunced. i In-dal term would be 2 years — 


‘loch edavional ford Wraponing Tal jodie] process on wore than thre subjects, end submit inal dlapoetion farm (la) for eneh wubjec 


Remarks was sentenced under the Federal Youth Corrections Act. bic 
He was ordered to make restitution in the amount of $87.00 and 
to serve 200 hours of community service. f, . / 
Field oftee = (1 — -633}e(L-Statistics in Process) PIN:kar {4) 
"Se cotos on covers sia. Sunegteggi ask Secon Fate ocuo env wien and wonton 
**Injomt operation BREN SE SG cca Law enforcement (Lt ageney ihe Remarks Secton, e1/Dos 


(7 the 


Property Type Codes* Potentia! Economic Loss Prevented (PELP} Type Codes* 
aM 


Code Code 
No Description No Description AERO 8 1985 
Gash (U.S. and foreign currency) 22 Counterfeit Stocks, Bonds, Currency or Negotiable Instruments 
2 — Stock, Bonds or Negotiable Instruments (checks, travelers checks, 23 Counterfeit or Pirated Sound Recordings or Motion Pictures 
money orders, certificates of deposit, etc} 24 Bank Thett Scheme Aborted 


3 General Retail Merchandise (clothing, food, liquor, cigarettes, TVs, etc) | 25 Ransom, Extortion or Bribe Demand Aborted” 
4 Vehicles (autos, trucks, tractors, trailers, campers, motorcycles, etc) | 26 — Theft from, or Fraud Against, Government Scheme Aborted 
5 Heavy Machinery & Equipment {heavy equipment, computers, etc} 27 Commercial or industrial Theft Scheme Aborted 
6 Bulk Materials (grain, fuel, raw materials, metals, wire, etc) 
7 — Jewelry (including unset precious and semiprecious stones) 
8 — Precious Metals (gol, silver, silverware, platinum, eto) 
3 Art, Antiques or Rare Collections 
10 Dangerous Drugs 
11 Weapons or Explosives 
12 Businesses or Assets Forfeited 30 All Other Potential Economic Loss Prevented (not falling in any 
20 All Other Recoveries (not falling in any category above} category above) 


*The case file must contain an explanation of the computation of the recovery value or loss prevented. An explanation airtel must accompany this 
report if the recovery is $1 million or more, or if the PELP is $5 million or more. 


‘Subject Description Codes* 
- Entar Description Code Only When Reporting a Conviction - 


Organized Crime Subjects: Union Members: 
1A Boss, Underboss or Consigliere 5A international or National Officer 
1B Capodecina or Soldier 6B Local Officer 
1G Possible LCN Member or Associate 5C Union Employee 
1D OC Subject Other Than LCN Government Officials Or Employees: 
Known Criminals {Other Than OC Members): Federal State Local 
2A Top Ten or 1.0. Fugitive 6A Presidential Appointee 6d Governor 6R Mayor 
2B Top Thiet 6B U.S. Senator 8K Lt. Governor 
2C Top Con Man 6C U.S. Representative 6L Legislator 6S Legislator 
Foreign Nationals: €D Judge 6M Judge 6T Judge 
3A Legal Alien 6E Prosecutor 6N Prosecutor 6U Prosecutor 
3B Hlegal Alien 6F Law Enforcement Officer 6P Law Enforcement Officer 6V Law Enforcement Officer 
3C Foreign Official Without Diplomatic Immunity 6G Fed Exec - GS 13 & ahove 6Q All Others - State 8W Al Others - Locat 
3D U.N. Employee Without Dipfomatic Immunity 8H Fed Empl - GS 12 & below 
3E Foreign Students Bank Officers or Employees: 
SF All Others 7A Bank Officer 
Terrorists: 7B Bank Employee 
4A Known Member of a Terrorist Organization All Others: 
4B Possible Terrorist Member or Sympathizer 8A All Other Subjects {not fitting above categories) 


‘if a subject can be classified in more than one of the categories, select the most appropriate in the circumstance. 


Instructions 


Subject Priorities for FBI Arrest or Locates: 

A. Subject wanted for crimes of violence (i.e. murder, manslaughter, forcible rape, robbery and aggravated assault) or convicted of such crimes in the past five 
years. 

8 - Subjects wanted for crimes involving the loss or destruction of property valued in excess of $25,000 or convicted of such crimes in the past five years. 
C - All others 

Claiming Convictions Other Than Federal: 
It is permissible to claim a focat (state, county or local) conviction if the FBI's investigation significantly contributed to the successful local prosecution. A 
succinct narrative setting forth the basis for claiming a local conviction must accompany this report. When claiming a conviction other than Federal, enter the 
word "LOCAL" in the Conviction-Section” block, disregard the number of conviction counts, but enter the sentence in the appropriate blocks. Enter “LF” in 
the “In-Jail” block for all life sentences and “CP” for all capital punishment sentences. 

Reporting Convictions: 
Convictions should not be reported until the sentence has been issued. There are two exceptions to this rule. ‘The conviction information can be submitted 
by itselt if: 
1. The subject becomes a fugitive after conviction but prior to sentencing 
2. The subject dies after conviction but prior to sentencing. 
‘An explanation is required in the Remarks section for either of the above exceptions. 

Rule 20 Situations: 
The field office that obtained the process (normally the office of origin) is the office that should claim the conviction, nat the office where the subject enters the 
plea in cases involving Rule 20 of the Federal Rules of Criminal Procedures. 

Investigative Assistance or Techniques (IA/Ts) Used: 
-Since more than one IA/T could have contributed to the accomplishment, each A/T must be rated. ” 
-The IA/T used must be rated each time an accomplishment is claimed. (For example - if informant information was the basis for a complain.an arrest, 2 
tecovery and a conviction and it separate FD-515s are submitted for each of the aforementioned accomplishments, the “Informant Information” block must be 
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96-4H BSL @ 


to pe . L_ 6b 


costed: Thu Sep 8, 1983 
In ome ADMIN/BMW 


mis(BMnin 
1o:iS PM EDT Msat EGID-1621-2306 
be 
b7C 


bit Monthly Update 


« 


The situation at Telenet continues to be unsettled» as thase af you 
the FAY System can see on the BBs. Therefore, the moratorium against 
cking Telemail accts has been extended until the end of September. 


that time, we can continue on with a vengance: and introduce the new 
porte inte the wars ef the “Usercode’. 


A new'Area update has been sent to those currentiy involved in the 
iC HACK project. We stili de mot have a date an the password cutover> 
thoush the end of the vear has been hinted at for MILNET implementation. 


STILL NEEL suest accts on MIT and SRI hosts» as well as the new FTP 
CS. 


Anvone with info on any of these should pass it on via the ARFA 
.st. 


And last but met least -- another reminder NOT ta take the Telemail 
stomer survey they are touting on the BB. It is partly designed as a 
fare te validate authorized system users, and our unresistered area would 
and cut like a-sare thumb should they take a claser look... 


ter, all. 


be 
b7C 


Osany lives! 


mmarid’? 


196-7 7/ B-4@ 


“ Ne such commands <.7 
Command? $ PURGED 
Bulletin Board contains? 


No. 


3 Sep @ 22:02[ 


DelYivered From 


Command? R PURGED 3 

Pested? Thu Sep 9, i983 10:02 PM EDT 
Fromt MIS/BMWNA/BMW 

Tot 

ces 

Subs ARPA#NET UPDATE 

SACHA TEE SE SESE AE TELE 

DATE: WED 7 SEP 83 12:40:00-PDT 

FROM: NIC@SRI-NIC 

SUBJECT: DDN NEWSLETTER NG. 32 


Subject 


ARPA#NET LIPDATE 
Pursed 


Mset EGID-1621-2254 


Same cuwslettyr? 


7 SEP 33 
(415) 959-3695 


NETWORK INFO CENTER FOR 
DCA DUN PROGRAM MGMT OFFICE 
NIC@SRI-NIC 


DEFENSE DATA NETWORK NEWSLETTER 


CMAXIMUM DISTRIBUTICN REQUESTED. 


CONTACT NIC@SRI-NIC. 
<DDN-NEWS> AT SRI-NIC £10.0.0,731.1 


SECTION I. GFFICIAL 


THE DDN NEWSLETTER 
THE NETWORK INFORMATIGN CENTER UNDER DCA CONTRACT. 
BACK ISSUES OBTAINABLE BY FTP FROM THE DIRECTORY 


IS PUBLISHED BY 
FUR SUBSCRIPTION, 


TAC-NEWS SERVICE 


= MILNET/ARPANET HOST AND TAC ALIGNMENT LIST 


TAC-NEWS SERVICE 


A NEWS SERVICE FOR TACS HAS BEEN INSTALLED. 


THIS SERVICE WILL BE USED 


TQ INFORM TAC USERS OF IMPORTANT CHANGES IN THE ARPANET AND MILNET, AS 


WELL AS FOR TAC-SPECIFIC NOTICES. 


TQ REACH THIS SERVICE FROM A TAC, 


USE THE "@N" COMMAND TG THE TAC AND THE CONNECTION WILL AUTOMATICALLY 


BE MADE, 

“TAC-NEWS" 
MAILBOX OF NOTICES 
COMMAND IS INVOKED. 


THE USER 
(NG PASSWORD REQUIRED). 


SHOULD THEN LOG IN WITH USERNAME 
THE TACNEWS 
IN REVERSE CHRONOLOGICAL ORDER WHEN THE 


"“TACNEWS" OR 
PROGRAM WILL SCAN A 
"ent 


GO- YH/8-/e 


o y 


MILNET/ARPANET HOST AND TAC ALIGNMENT LIST 


“IN DDN NEWSLETTER NG. 31, DATED i SEP 83, TAC USERS WERE ADVISED THAT 
THEY SHOULD KNOW THE NET ALIGNMENTS OF THE TACS AND HOSTS WHICH THEY 
COMMONLY USE. THIS KNOWLEDGE IS ESPECIALLY CRITICAL FOLLOWING THE 
MILNET/ARPANET SPLIT (4 OCT 83) AND THE TWO TEST DAYS PRECEDING IT 
(3 AND 15 SEP 83). A COMPLETE LIST GF TACS AND HOSTS ON EACH NET WILL 
BE PLACED IN A NOTICE AVAILABLE THROUGH THE TAC~NEWS SERVICE DESCRIBED 
ABOVE. “ALL TAC USERS SHGULD OBTAIN A COPY OF THIS LIST PRIOR TO 
8 SEP 83. 


TAC USERS ARE ALSO REMINDED THAT THEY MUST USE THE COMPLETE INTERNET 
ADDRESS SCHEME IF THEY WISH TO CONNECT TO A HGST ON A DIFFERENT 
NETWORK FROM THE TAC THEY ARE USING. AN EXAMPLE OF THIS. FORM OF 
ADDRESS IS! 10,1.0.40, WHERE + 


10 IS THE NETWORK NUMBER CF THE HUST BEING ACCESSED (10 FOR ARFANET, 
26 FOR MILNET)3 


1 IS THE PORT NUMBER OF THE HOST BEING ACCESSED: 
0 IS RESERVED AND CURRENTLY IS USUALLY 03 
40 IS THE NUMBER OF THE IMP TG WHICH THE HOST IS CONNECTED. 


~~~-END-OF~MESSAGE--—- 


HERR E EEE 

DATE: 6 SEP 1983 15:53:20 EDT (TUESDAY?) 
FROM: BEN LITTAUER <LITTAUER@BBN-UNIX> 
SUBJECT: TAC SPLIT INFO !! 


Heeeexese MILNET/ARPANET HOSTS 


Command? 


/GO-YPA 3B ~/) b 


? 


Postedt Thu Sep §& 1989 5:49 PM EDT 
From? 

Toe 

SubJt STTNET (£CMI, 


HELP BITNET 


BITNET NODES 


NODENAME 
System 
OL CUNYVM 
VM/SP 

IBM 4341-1 
02 CUNYJESS 


University Name 


MACHINE 


y University of New York ° 


City University af New York 


MVS/JES3 IBM 2033 


03 BMOOZ 
VM/SP 
IBM 4331-II 
BMADMN2 
04 BXO001 
VeM/SP 
IBM 4331 
OS KBOOL 
VM/SP 
IBM 4331 
06 STOOL 
VvM/SP 
IBM 42341 
07 QBOOL 
VM/SP 
IBM 4341 
O08 NYOOL 
VM/SP 
IBM 4331-I1 
NYO? 
09 LCOO3 
VM/SP 
IBM 4341 
10 BROO3 
VM/SP 
IBM 4331 
11 BMACADM 
VM/SP 
IBM 4331 
i2 BBADMIN 
VM/SP 
IBM 4331 
13 BKLYN 
VM/SP 
IBM 4341 
BCO0O03 
BCOOS 
14 HUNTER 
VM/SP 
IBM 4341 
1S CCNY 
VM/SP 
IBM 4341 
1& YALEVM 


CUNY - Bara of Manhattan Comm Col 


Alias to BMOO2Z 
CUNY ~ Bronx Community Collese 


CUNY - Kingsboroush Comm Collese | 
CUNY ~- Collese of Staten Istand : 
CUNY ~ Queensborough Camm Collese 
CUNY ~- NYC Technical Collese 


Alias to NYOOL 
CUNY ~ Lehman Callese 


CUNY - Baruch Cotlese 

CUNY - Baro of Manhattan Camm Cat 
CUNY - Baruch College 

CUNY ~ Brooklyn Callese 


Alias to BKLYN 
Alias to BKLYN 
CUNY ~- Hunter Callese 


CUNY ~ City Callese 


Yale University 


EME [Teor 


OGIN-1421-1328 


WVO-S PLB DE 


VM/SP ° 
TBM 4341-11 
17 YALEMVS Yate Universit MVS/JES3 IBM 370/163 
20 PSUVM Penn State University 
| ¥M/SP 
IBM 4341 : 
21 PSUVAX1 Penn State University 
VMUNIX ‘VAX 11/780 
22 PSUMVS | Penn State University 
MVS/JESZ IBM 3081 
223 PSUPDPL Penn State University 
UNIX R& POP 11/34 
24 BROWNVM - Brown University 
V¥M/SP 
IBM 4341-11 
BROWNVM{ Brown University 
BROWNVM2 Brown Liniversity 
BROWNVM3 Brown University 
25 CORNELLC Carnell University 
VM/SP 
IBM 370/168 . 
CORNELL Alias te CORNELLC 


CUNYMI Alias to CORNELLC 
26 CORNELLA Cornell University 
VM/SP 


IBM 4241-11 
CUNYVM2 Atias te CORNELLA 
27 CORNELLB Cornel? University 
UM/SP 
IBM 42341-IT 
CUNVMS Alias ta CORNELLB 
29 CRNLMVSB Corne?] University 
MVS/JESZ suest @ CUNVMS 
CUNMVS3 Alias to CRNLMVSB 
2? CUMC Cornell University Medical Center 
VM/SP 
IBM 4331-1 
20 CRNL20A Carnell University 
TOPS/20 DEC 2060 
CUNZ060 Alias to CRNL2OA 


31 CUVMA Columbia University 
VM/BSEPP IBM 4341-I1 
32 CUVMB ” Columbia University 
VM/BSEPF IBM 4341-11 
CU2ZO0A Columbia University 
TOPS-20 DEC 2060 
CU20B Celumbia University 
TOPS-26 DEC 2060 
cuzoc Catumbia University 
TOPS-20 DEC 2060 
CWRUZO Case Western Reserve University 
TGPS-20 DEC 2060 
32 PULC Princeton University 
VM/SF 
IBM 3081 
34 YALEADSS Yale University 
VM/SP 
AS3-S 
35 YALEADSi Yale University 
VM/SP 


IBM 4341-11 
3&6 ROCKVAX Rockefeller University 
VMUNIX | VAX 11/780 


LUO-VY UBS 2, 


37 BOSTONU = Boston Univeristy 
VM/SP (MP) IBM 3081-3 
38 UCBVMA University California at Berkeley 
VM/SP 
IBM 4341-II 
37 UCBUNIXA Univ. California at Berkeley 
2.3 BSD PDP 11/7California at Berkeley 
2.3 BSD PRP 11/70 
43 UCBUNIXE Univ. California at Berkeley 
2.8 BSD PDP 11/70 
44 UCBUNIXF Univ. California at Berkeley 
2.8 BSB PDP 11/70 
45 UCBUNIXG Univ. California at Berkeley 
4,0 BSD VAX 11/7280 
46 SFASYS Univ. Califarnia San Francisco 
VM/SP 
IBM 4341 
47 SFRSYS Univ. California San FRancisco 
VM/SP 
TRM 4341 
43 MITVMA Massachusetts Institute of Tech. 
VM/SP 
IBM 370/163 
49 MITVMB Massachusetts Institute of Tech. 
30 MITYMC Massachusetts Institute of Tech. 
31 MITVMD Massachusetts Institute of Tech. 
32 MITMULT Massachusetts Institute of Tech. 
33 CRNLCS Cornell Computer Science Dept. 
UNIX . 
VAX 11/780 
34 UORVM University af Rochester 
VM/SP 
IBM 3032 
35 SUNYBING SUNY at Binghamton - 
VM/SP : - 
NAS AS6 
56 HARVARDA Harvard University 
VM/SP 
IBM 4341-II 
YETVMYV 
YKTVMX TEM Yorktown 
PORTLAND University of Maine at Portland 
GWUVM Georse Washinstan University 
CUVMC Columbia University 
VM/SP 
TRM 4341-11 
CUYMD Columbia University 
VM/SP 
IBM 3031 
CUCHEM Columbia University Chemistry Dept. 
BEC VAX 11/7806 


Posted? Thu Sere 8, 1983 5:55 PM EDT 
Trem 

Tor 

Bub:  “DECNET tomy 


Msst DGIB+1621-1397 


INTRODUCTION TO DECNET 


JECNET is a network facility, provided by DIGITAL EQUIPMENT CORPORATION, 


b6 
BIC 


i SLA 


which enables users to do work invelving access to another system in the 
network. For a brief description of the facilities which call upon DECNET, 
type or print the files HLP:DECNET.DOC . Each of these programs involves 
specifvina the network node vou wish to communicate with. Below are the names 
of all the currently available nodes. 


RHEKEHEHRHH REA AREER EEE REA RE RAE EEL ERA EAE EERE RHE ER RHEE EEE RR HR ERE EER REE 
BECNET NODE NAMES 


DECNET currently recegnizes the following as valid node names: 


Carnegie Mellon University — 


Computation Cente 


CMCCRA =- "RSTS-A" CMCCRB —- “RSTS-B" CMCCTA — "TOPS-A" 
CMCCTB - “TOPS-B" eMccTtc - “TaPs-c* CMecTo - "TOPS-p" 
CMCCTE - "“TOPS-E" CMCCTF —- “TOPS-F* CMCCVA - "VAX-A" 


Chemistry Department: 
CMCHEM =~ "VAXC" 


Computer Science Departments 
cMcsc - "cMUCc" CMCSPS —- “Production Systems” 


Physics Department: 
CMPHYS —- "VAXP™ 


Psyrchelosy Department: 
CMPSYA — "PSYA". CMPSYB - “PSYB 


Cotumbia University ~ 
Center for Camputinas Activities: 
CU2OA CU2Z0B cuz0c cu200 


Chemistry Department: 
CUCHEM 


Case-Western-Reserve University — 


Jennings Computing Center: 
CWRUZO CWR2Z0B 


HHL HALAL REEH REPRE HERE AR ELLE REE HK KEELER HEE HEH HERE EER RHEE EEE EEE EERE 
Presrams which use DECNET include HOST, NFT, WHERE, and the mail prosram MS. 
Fer more information on these programs, type HELP, a space: and the name of 

the program you wish to learn more about. 


Carnesie-Metlon is on another network, BITNET;: which can be used enly far 
mail. Type HELP BITNET for details. 


Te learn which DECNET links are available at a rarticular mament, tyre 
INFORMATION DECNET NODES 

For a description of the operating system at each DECNET node» tyre 
INFORMATION DECNET DESCRIPTION 


or vou may Print the files HLPSDECNET-DESCRIPTION.TXT . 


VGE-VA/ BLY 6 


@INFORMATION DECNET NODES 
Local DECNET node? CMCCTA 


Accessibte DECNET nodes are: CMCCTA CMCCTB CMCCTC CMCCTR CMCCTE CMCCTF 
CMCCVA CMCCVB CMCCXA cCMCSC CMCSP1 COMPHYB CMPHYS CMPSYA CMPSYB CMPSYC 
CMPSYD CMSTAT CLIZ0A CU2CB cu20c cuzo0 CUCHEM CUCHMB CUTC20 CWR20B 


CWR2Z0C CWRUZ0 DN20 
@INFORMATION DECNET DESCRIPTION 
Carnesie Mellon University? 
Computation Center: 
CMCCRA - PDP-11/45 RSTS V7 —- "RSTS-A" 
CMCCRB — POP-11/45 RSTS V7 - "RSTS-B" 


CMCCTA — DECsystem-Z060 TOPS-20 V5.1 — "TOPS-A" 
CMCCTB — DECsrstem-Z060 TOPS-20 V5.1 —- “TOPS-B” 
CMCCTC - DECsystem-2060 TOPS-20 VS.1 - "TOPS-c" 
CMCCTD — DECsystem-Z2060 TOPS-20 V5.1 - "TOPS~D" 
CMCCTE — DECsystem—-2060 TOPS-20 V&.i - “TOPS-E" 
CMCCTF — DECsystem-Z2060 TOPS-20 V5.1 - "TOPS-F" 


CMCCVA - VAX-11/780 VMS V3.0 - "VAX-A" 
Chemistry Department: 

CMCHEM — VAX-11/780 VMS V3.0 
Computer Science Department: 

CMCSC ~ DECsystem-2060 TOPS~20 V5.1 -— "CMUC* 

CMCSPS — VAX-11/780 VMS V3.0 - “Production Sys 
Physics Derartment: 

EMPHYS -— VAX-11/780 VMS V3.0 
Psychalesy Derartment? 

CMPSYA — VAX-11/780 VMS V3.0 

CMPSYB - VAX-11/750 VMS V3.0 


Columbia University: 

Center for Computing Activities: 
CU208 - DECsystem-2040 TOPS-20 VS" 
CU20B ~- DECsystem-2060 TOPS-20 V& 
Cuz0c ~ DECsvstem-2060 TOPS~20 VS 
CU2ZOR — DECsystem—-2060 TOPS-20 VS 

Chemistry Department? 

CUCHEM - VAX-11/780 VMS V2.0 


Autolosout 
<illed Job 48, TTY 72, at @-Ser-83 17116:05 


Carnesie-Mellon University, UCC MICOM-A 


?ORT GROUP? 1 
1 


JNASSIGNED 


?ORT GROUP? 1 
L 


3econdary micom for CMCCTA 

30 

Carnesie-Mellon University TOPS-A on node CMCCTA, 
BINFORMATION BECNET DESCRIPTION 


larnesie Mellon University? 
Computation Center? 


tems" 


TOPS-20 Menitor 5.1(5050)-2 


/96~ YLBA-~H 


CMCCRA ~ PRP-11/45 RSTS V7 - "RSTS-A" 
CMCCRB - POP-11/45 RSTS V7 - "RSTS-B" 


CMCCTA — DECsystem-2060 TOPS-20 V5.1 — "TOPS-A" 
CMCCTB ~ DECsystem-2060 TOPS-20 V5.1 - "TOPS-R" 
CMCCTC — DECsystem-2060 TOPS-20 V5.1 - "TOPS-c" 
CMCCTD — DECsystem-2060 TOPS~-20 V5.1 — "TOPS-H" 
CMCCTE - DECsystem~2060 TOPS-20 V5.1 - "TOPS-E" 
CMCCTF — DECsystem-2060 TOPS-20 V5.1 - "TOPS-F" 
CMCCVA - VAX~11/780 VMS V3.0 ~ "VAX-A" 
Chemistry Department: 
CMCHEM — VAX-11/780 VMS V3.0 
Computer Science Department: 
CMCSC — DECsystem-2060 TOPS-20 V5.1 - “CMUCc" 
CMCSPS - VAX-11/780 VMS VZ.0 - “Production Systems" 


Physics Departments 
CMPHYS -— VAX-11/780 VMS V3.0 
Psychalosy Derartment? 
CMPSYA — VAX-11/780 VMS V3.0 
CMPSYE —- VAX-11/750 VMS V3.0 


Columbia Universitys 

Center far Computing Activities: 
CU2Z0Q — DECsystem-2060 TOPS-20 V5 
CU2ZOB -— DECsystem~2060 TOPS-20 VS 
CU20C — DECsystem-2060 TOPS-20 V5 
Cu20D ~ DECsystem-2060 TOPS~20 V5 

Chemistry Department: 
CUCHEM - VAX-11/780 VMS Vz.0 


Case-Western-Reserve University: 
Jennings Computins Center: 
CWRUZO - DECsystem-2060 TOPS-20 V4 
CWR20B - DECsystem-2060 TOPS-20 V4 


Posted: : en 8251983 5 9146 PM EDT: 


Fram? 
Tor 
Subj: ArraxNews 
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DATE: WED 7 SEP 83 12:40:00-PDT 
FROM! NIC@SRI-NIC 

SUBJECT: DDN NEWSLETTER NO. 32 


DDN-NEWS 32 
7 SEP 33 
(415) 859-3695 


NETWORK 


DEFENSE DATA NETWORK NEWSLETTER 


CMAXIMUM DISTRIBUTION REQUESTED. THE DUN NEWSLETTER 


THE NETWORK INFORMATION CENTER UNDER DCA CONTRACT. 


et... Messe 


IGID-1621-2232 


bIC 


INFO CENTER FOR 
DCA DDN PROGRAM MGMT OFFICE 


NIC@SRI-NIC 


IS PUBLISHED BY 
FOR SUBSCRIPTION, 


CONTACT NIC@SRI-NIC. BACK ISSUES OBTAINABLE BY FTP FROM THE DIRECTORY 
<DDN-NEWS> AT SRI-NIC £10.0.0.73].3 


SECTION I. GFFICIAL 
TOPIC: ~ TAC-NEWS SERVICE 


/Ge-Y FEE 


- MILNET/ARPANET HOST AND TAC ALIGNMENT LIST 


TAC-NEWS SERVICE 


4 NEWS SERVICE FOR TACS HAS BEEN INSTALLED. THIS SERVICE WILL BE USED 
TO INFORM TAC USERS OF IMPORTANT CHANGES IN THE ARPANET AND MILNET, AS 
WELL AS FOR TAC-SPECIFIC NOTICES. TQ REACH THIS SERVICE FROM A TAC, 
USE THE "“@N" COMMAND TQ THE TAC AND THE CONNECTION WILL AITOMATICALLY 
BE MADE. THE USER SHOULD THEN LOG IN WITH USERNAME "TACNEWS" UR 
"TAC~NEWS" (NU PASSWORD REGUIRED). THE TACNEWS PROGRAM WILL SCAN A 
MAILBOX OF NOTICES IN REVERSE CHRONOLOGICAL ORDER WHEN THE "@N" 
COMMAND IS INVOKED. 


MILNET/ARPANET HOST AND TAC ALIGNMENT LIST 


IN DDN NEWSLETTER NO. 31, DATED 1 SEP 93, TAC USERS WERE ADVISED THAT 
THEY SHOULD KNOW THE NET ALIGNMENTS OF THE TACS AND HOSTS WHICH THEY 
COMMONLY USE. THIS KNOWLEDGE IS ESPECIALLY CRITICAL FOLLOWING THE 
MILNET/ARPANET SPLIT (4 OCT 83) AND THE TWO TEST DAYS PRECEDING IT 
(3 AND 15 SEP 83). A COMPLETE LIST OF TACS AND HOSTS ON EACH NET WILL 
BE PLACED IN A NOTICE AVAILABLE THROUGH THE TAC-NEWS SERVICE DESCRIBED 
ABOVE. ALL TAC USERS SHOULD OBTAIN A COPY OF THIS LIST PRIOR To 
3 SEP 33, : 


TAC USERS ARE ALSO REMINDED THAT THEY MUST USE THE COMPLETE INTERNET 
ADDRESS SCHEME IF THEY WISH TO CONNECT TO A HOST ON A_ DIFFERENT 
NETWORK FROM THE TAC THEY ARE USING, AN EXAMPLE OF THIS FORM OF 
ADDRESS 15: 10.1.0.40, WHERE 


10 IS THE NETWORK NUMBER OF THE HOST BEING ACCESSED (10 FOR ARPANET, 
26 FOR MILNET)$ 


1 IS THE PORT NUMBER OF THE HOST BEING ACCESSED: 
© IS RESERVED AND CURRENTLY IS USUALLY OF 
40 IS THE NUMBER OF THE IMP TO WHICH THE HOST IS CONNECTED. 


~~-—~END-OF-MESSAGE-—-—— 


HAH SEES eae HE Se eae 
DATE? 3 25252 T (TUESDAY) 
FROM: BBN-UNIX> 


SUBJECT? TAC SPLIT INFO !! 


weneeeteH MILNET/ARPANET HOSTS AND TACS = wataeseseaesesese 


THE FOLLOWING LISTS ARE PROVIDED TO ENABLE TAC USERS TO DETERMINE THE 
NETWORK ALIGNMENT, ARPANET OR MILNET, OF THE TAC(S) AND HOST(S) WHICH 
THEY NORMALLY USE. FOLLOWING THE MILNET/ARPANET SPLIT (4 GCT 83) AND 
ON THE TEST DAYS (8 AND 15 SEP 83); EVERY REASONABLE EFFORT SHOULD HE 
MADE TO USE A TAC ON THE SAME NETWORK AS THE HOST BEING ACCESSED. 


TAC USERS ARE ALSO REMINDED THAT ON THE TEST DAYS, AND FOLLOWING THE 
SPLIT, THEY MUST USE THE FULL INTERNET ADDRESS OF THE HOST THEY WISH 


bé 
b7c 


[FO-S PIB LE 


TO access IF IT Is NOT ON THE SAME NET AS THE TAC THEY ARE USING. FOR 
EXAMPLE, TO ADDRESS THE HOST DDN1 FROM AN ARPANET TAC, IT WOULD BE 
IECESSARY TO ENTER THE COMMAND TO THE TAC: 

20 26.3.0.82 

WHERE 26 IS THE NETWORK NUMBER FOR MILNET, 

3 IS PORT NUMBER FOR DDNI, 

0 IS A RESERVED POSITION, CURRENTLY ALWAYS A "OQ", 

AND 82 IS THE IMP NUMBER FOR DDN1. 

FHE INFORMATION IN THESE LISTS IS CURRENT AS OF & AUGUST &2. A REVISTON 


NILL BE POSTED APPROXIMATELY ONE WEEK PRIOR TO 4 OCT WHICH WILL BE CURRENT 
S OF THE DATE POSTED. 


IMP #. HOSTS ON IMP. 


3. NOSC-CC, LOGICON, NPROC, NOSC~TECR. 


a. “AIC, NSWC-WO, NRL-ARCTAN, NRL-CSS, NRL-TOPS10. = 
13. A 

14, CMU-10A BES 
16. AMES-TSS, AMES-VMSA, AMES-VMSB. 

17. MITRE. 


18. RADBC-MULTICS, RADC-TOPS20, RADC-UNIX, GE-CRD. 
19. NBS-VMS, NBS-SDC, NBS-UNIX, NBS-PL, NBS-AMRF, NBS-SSI. 
20. DCA-EMS, DCEC-BRIDGE. 

21. LLL-TIS, LLL-MFE, LLL-ZDIVISION. 

22, USC-ISI. 

23. USC-ECL: USC-ECLB. 

24. NADC. 

29. BRL, APG-1. BRL-GATEWAY. 

33. NPS; FNOC-SECURE. 

34. LBL-NMM, LBL-CSAM, 

35. NOSC-SECUREZ, NOSC-TECR, NOSC~SECURES. 
36. COINS-TAS, CINCPACFLT—WM. 

43. OFFICE-1, OFFICE-2, OFFICE~3, OFFICE-7. 
44. MIT-MC. 

45. PICA. 

46. OKC-UNIX. 

47. WPAFB, WPAFB-AFWAL. 

48. AFWL. 

49. BBN-TENEXB, BRN-TENEXC. 

SZ. USC-ISIE, ISI-VAXB. 

53. AFSC-AD, AFSC-BEV, NCSC. MARTIN. 

54. ACC, JPL-VAX. 

S&. ANL-MCS. 

57. TYCHO, COINS~-IG, 

Se@. NYU, BNL. 

61, STL-HOST1, ALMSA-1. 

64. MARTIN-B, ROBINS-UNIX. 

65. AFSC~SD, AEROSPACE. 

6& MITRE-BEDFORD, AFGL1. 

67, AFSC-HG. 


/GO-V FL B-“G@ 


USGS1-MULTICS, USGS1-AMDAHL. 
USGS2-MULTICS. 

USGS3-MULTICS, USGSS-VMS. 
BBNP, 

SRI-NIC, SRI-WARF. 

WSMR-70A, WSMR-70B, SIMTEL20. 
YUMA, 


"MCCLELLAN. 
NEMS; NALCON, NSRDCOA. 


BBNT: BBN-RSM, UDNi, TEST-MAILBRIDGE. 
TAC-NEWS, TEST-BRIDGE. 

NSWC~DL, NSWC-G, NSWC-GAS. 
NWC-387A, NWC~3S7B. 

SANBIA, 

NLM-NCS. 

LANL. 

NUSC-NPT, NUSC. 

DOFFICE-8, OFFICE~10, OFFICE-15. 
SI-GATEWAY: Si-A, S1-B, Si-C. 
PAXRV-NES. 


#. TAC 


GUNTER-TAC. 

AMES-TAC. 
MITRE-TAC. 

RADC-TAC. - 
BCEC-TAC. - ee 
PENTAGON-TAC. 
ARPAI-TAC, ARPA2-TAC. 
BRL-TAC. 

BROOKS~TAC,. 

NPS-TAC, 

ACCAT-TAC. 

ALOHA-TAC. 

NCC-TAC. 
REDSTONE-TAC. 
ARRADCOM-TAC 
WPAFB-TAC. 

AFWL-TAC, 

DARCOM-TAC, 
EGLIN-TAC, 

SCOTT-TAC. 
CRBCML-TAC, CRDCM2-TAC. 
STLA-TAC. 

ROBINS~TAC. 

AFSI-TAC. 

AFGL-~TAC. 

ANDRUS-TAC. 
USGS1-TAC. 

USGS2~TAC. 

USGS3-TAC. 

WSMR-TAC. 

YUMA-TAC. 

SACZ-TAC. 

DAVID-TAC. 


496-9213 Jb 


NSWC~TAC. 
CHINA-TAC. 
PAXRV-TAC, 


ae ARPANET HOSTS-~——~ 


'#. HOSTS ON IMP. 


UCLA-CS, UCLA-ATS, UCLA-CCN,» UCLA-SECURITY. 
SRI-NSCi1, SRI-KL, SRI-CSL, SRI-TSC. 

UTAH-CS, UTAH-20. 

BBNF; BENG; BBN-PTIP, BBNA. 

MIT-MULTICS, MIT~DMS, MIT-AI, MIT~ML. 
RAND-RELAY: RAND-UNIX. 

HARV-10, YALE. 

LL, LL~XN, LL-VLSI, LL-EN, LL-GATEWAY, LL-i1. 
SU-AI, SU-SCORE, STANFORD~GW. 

CMU-10B, CMU-GATEWAY, CMU-20C. 

ROCHESTER. 

DCN-GATEWAY, MITRE-GATEWAY, MITRE-LAN. 
RADC~PSAT-IG. 

DCEC~GATEWAY, EDN-UNIX, DCEC-PSAT~IG. 
ISI-SPEECHI1, USC-ISIC, ISI-PSAT-IG. 
USC-ECLC. 

WHARTON-10. 

SEISMQ, CSS-SAT-IG. 


-USC-ISID, ISI-PNGi1, ISI-VAXA, ISI-GWY. 


ARPA-DMS, ARPA-PENGUIN. 

CCA-UNIX, CCA-VMS. 

PARC-MAXC, KESTREL. 

PURBUE-IG, CSNET~PURDUE, 

BRAGG-GWY1, BRAGG-STAI, NETS-GW. 
BEN-PSAT-IG, BBN-VAN-GW, 

MIT-XX, MIT-TST-IG. 

COLLINS-PR, COLLINS, 

CHRONUS, CLARK-IG. BRN-CLXX. 
SRI-C3P0;, SRI-UNIX, SRI-R2D2, ST-NIC. 
USC-ISIF, USC-ISIB, 

CIT-20, CIT-VAX, 

SUMEX-AIM, SU-DSN, AINS-UNIX. 
RUTGERS. 

UTEXAS~11, UTEXAS-20, UTEXAS~-780. 
BEN-TESTO-GW, BEN-TEST2-GW, BBN-TEST3-GW. 
BEN-NU, BEN-UNIX, RCC-IG. 

SRI-AI, SRI-IuU. 

MIT-LCS-GW, MIT-OZ, MIT-BDEVMULTICS. 
UCB-ARPA, UCB-VAX. 

BEC-TOPS20, DEC-MARLBORG. 

HI-MULTICS, SAC~SAT-IG. 

BBN-VAX; BBN-NOC2. 

COLUMBIA~20. 

WASHINGTON, UW-VLST. 

WISC, CSNET~SH. 

UDEL-RELAY, UDEL-TCP, UDEL-EE, CORNELL. 


LGCY LB AE 


-----ARPANET TACS----- 
IMP #. TAC. 


4. UTAH-TAC. 
7.° RAND~TAC. 
11.4, SU-TAC. 

23. USC-TAC. 

31. CCA-TAC. 

38. BRAGG-TAC. 
46. COLLINS-TAC, 
63. BBN-TAC. 

77. MIT-TAC. 

#0. SAC1-TAC. 
91. WASH-TAC. 


REA ee 

DATE: THU 1 SEP 93 15:47:17-PDT 
=ROM? NIC@SRI-NIC _ 

SUBJECT: DDN MGT BULLETIN # 12 


EERE EH EEE EAHA ER EEE EEE LER REHEARSE EE PRE EERE RHR REAR EE 


ODN MGT BULLETIN # 12 NETWORK INFO CENTER FOR 
1 SEP 98s 2 DCA DDN PROGRAM MGT OFFICE 
(415) 859-3695 : - NIC@SRI-NIC 


DEFENSE DATA NETWORK 
MANAGEMENT BULLETIN 


THE DON MANAGEMENT BULLETIN IS PUBLISHED BY THE NETWORK INFORMATION 
SENTER UNDER DCA CONTRAST AS A MEANS OF COMMUNICATING OFFICIAL POLICY, 
PROCEDURES AND OTHER INFORMATION OF CONCERN TO MANAGEMENT PERSONNEL AT 
ODN FACILITIES. BACK ISSUES MAY BE OBTAINED BY FTP FROM THE DIRECTORY 


<DON-NEWS> AT SRI-NIC [£10,0.0.731. 
HELE ERA AH HEH HRA EE HARRAH EME EE HEE E EEE RR HER EH 


PUBLIC HOST AVAILABLE FOR SOFTWARE VERIFICATION 


aS BRIEFED IN THE RECENT HOST ADMINISTRATOR/TECHNICAL LIAISON 
MEETINGS, A PUBLIC HOST HAS BEEN ADDED TO THE NETWORK AS A 
SENERAL-PURPOSE TCP/IP HOST FOR NETWORK SOFTWARE TESTING. THE ADDRESS 
OF THE HOST IS S.7.0.4. SINCE THIS IS ON BBN-NET» NOT ARPANET, USE OF 
3 GATEWAY WILL BE REQUIRED TG ESTABLISH A CONNECTION. THE INTENT GF 
?ROVIDING THIS HOST IS TO ALLOW ARPANET HOST NETWORK SOFTWARE 
MAINTAINERS TO VERIFY THAT THEIR SOFTWARE IS CAPABLE OF ACCESSING A 
10ST ON A DIFFERENT NETWORK AND RESPONDS PROPERLY TO ICMP CONTROL 
MESSAGES. THE GUEST ACCOUNT NAMES AND PASSWORDS ARE NAME? “GUEST” + 
PASSWORD? "ANONYMOUS"; OR NAMES "ANONYMOUS", PASSWORD? "GUEST". 


----------- END-OF-MESSAGE-—-----~~-~~— 
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RELHRHREEEEHREEE 

DATE: THU 1 SEP 83 15:33:00-PDT 
FROM: NIC@SRI-NIC 

SUBJECT: DDN NEWSLETTER NQ. 31 


DON-NEWS: NETWORK INFO CENTER FOR 


i SEP 83 DCA DDN PROGRAM MGMT OFFICE 


(415) 859-3699 NIC@SRI-NIC 


DEFENSE DATA NETWORK NEWSLETTER 


CMAXIMUM DISTRIBUTION REQUESTED. THE DDN NEWSLETTER IS PUBLISHED BY 
THE NETWORK INFORMATION CENTER UNDER DCA CONTRACT. FOR SUBSCRIPTION, 
CONTACT NIC@SRI-NIC. BACK ISSUES OBTAINABLE BY FTP FROM THE DIRECTORY 
<DDN-NEWS> AT SRI-NIC [10.0.0,731.3 


SECTION I. OFFICIAL 


TOPIC! - MILNET/ARPANET SPLIT - TEST DAYS 


AS DESCRIBED IN NEWSLETTERS 2& THROUGH 29, THE ARPANET WILL BE SPLIT 
INTO THE MILNET AND. THE EXPERIMENTAL ARPANET ON OCTOBER 4, 1783. IN 
PREPARATION FOR THIS SPLIT, TWO FULL SCALE TEST DAYS HAVE BEEN 
SCHEDULED IN SEPTEMBER. THESE TEST DAYS ARE THURSDAY, SEPTEMBER & AND 
THURSDAY, SEPTEMBER 15. THE TESTS WILL INVOLVE COMPLETE CUTOVER TG THE 
SPLIT CONFIGURATION OF THE TWO NETWORKS. THE TESTS COMMENCE AT 12:00 
NOON EST AND TERMINATE AT 12:00 NGUN EST THE FOLLOWING DAY. 


HOST ADMINISTRATORS MUST ENSURE THAT NEW HOST NAME TABLES ARE LOADED 
AT THE START AND FINISH OF THE TESTS. (AN UPCOMING MANAGEMENT 
BULLETIN WILL HAVE FURTHER DETAILS ON HUST TABLE UPDATING.) FOR HOSTS 
MOVING TO MILNET, ADMINISTRATORS MUST ALSO ENSURE THAT THEIR HOST USES 
ITS NEW NETWORK 26 ADDRESS DURING THE TEST PERIOD. 


DURING THE TESTS, USERS OF TACS SHOULD BE AWARE OF THE NETWORK 
ALIGNMENT OF THE TACS AND HOSTS THEY USE. EVERY EFFORT SHOULD BE MADE 
TO USE A TAC ON THE SAME NETWORK AS THE HOST BEING ACCESSED. 


FURTHER DETAILS CONCERNING THE SPLIT: AND ITS RAMIFICATIONS FOR USERS 
AND ADMINISTRATORS, MAY BE FOUND IN THE ABOVE-MENTIONED NETWORK 
NEWSLETTERS. 


—-END~OF-MESSAGE-— 


HERE HRHER EEN 

DATE: THU 1 SEP @3 14:38:34-PDT 
FROM! NIC@SRI-NIC 

SUBJECT: DDN MGT BULLETIN # 11 (LONG) 


ERR EEE HH SEER HEE RENAME ESE NER AEM REEL HEH EEE EE EE 
DDN MGT BULLETIN # 11 NETWORK INFO CENTER FOR 
1 SEP 93 DCA DUN PROGRAM MGT OFFICE 
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(445) 859-3495 NIC@SRI-NIC 
DEFENSE DATA NETWORK 
MANAGEMENT BULLETIN 


THE DDN MANAGEMENT BULLETIN IS PUBLISHED BY THE NETWORK INFORMATION 
CENTER UNDER DCA CONTRACT AS A MEANS OF COMMUNICATING OFFICIAL POLICY, 
PROCEDURES AND OTHER INFORMATION OF CONCERN TO MANAGEMENT PERSONNEL AT 
DON FACILITIES. BACK ISSUES MAY BE OBTAINED BY FTP FROM THE DIRECTORY 
<BDN-NEWS> AT SRI-NIC £10.0.0.73]. 

REAGAN HRA EHR HERE EHH REEL RE AER ERE EERE ERR EH ER HEH ER ERE ES 


GATEWAY (MAILBRIDGE) HOMINGS FOR 
MILNET/ARPANET SPLIT AND TEST DAYS 


AHEN THE ARPANET IS SPLIT INTO THE MILNET AND THE ARPANET, ALL TRAFFIC 
BETWEEN THE TWO NETWORKS WILL HAVE TO TRAVEL VIA A GATEWAY. OR MAIL 
BRIDGE. BECAUSE OF THE LARGE VOLUME OF TRAFFIC WHICH IS EXPECTED, 4 
SATEWAYS WILL BE PLACED BETWEEN THE TWO NETWORKS. IN ORDER TG 
SFFECTIVELY DIVIDE THE TRAFFIC AMONG THESE GATEWAYS, HUSTS WILL BE 
ASSIGNED TO A “PRIMARY” GATEWAY AND A “SECONDARY” GATEWAY. THE LATTER 
IS TO BE USED IN THE EVENT THAT THE PRIMARY GATEWAY IS NOT AVAILABLE. 
HOSTS WHICH SEND TRAFFIC TO THE WRONG GATEWAY WILL RECEIVE AN ICMP 
REHIRECT MESSAGE INFORMING THEM OF THE APPROPRIATE GATEWAY TO BE USED. 


IN THE TABLES WHICH APPEAR BELOW, COMPLETE INFURMATION IS PROVIDED 
ABOUT WHICH GATEWAY SHQULD BE USED BY EACH HOST DURING THE SEPTEMBER 2 
TEST OF THE LOGICAL SPLIT OF THE ARPANET. THE FIRST TABLE PROVIDES 
THE NAMES OF EACH OF THE GATEWAYS BETWEEN THE ARPANET AND THE MILNET. 
IN ABBITION, THE ARPANET ADDRESS OF BOTH NETWORK INTERFACES ARE 
*ROVIBED FOR EACH GATEWAY. THE SECOND TABLE DESCRIBES WHICH OF THE 
SATEWAYS SHOULD BE USED BY HOSTS ON EACH IMP. FOR EXAMPLE, A HOST 
AHICH IS ASSIGNED TO THE MILNET AND ~WHICH IS HOMED TO IMP 3 (NOSC) 
SHOULD SEND TRAFFIC -TO THE ARPANET VIA THE MILNET INTERFACE OF THE 
MILISI GATEWAY. SIMILARLY, AN ARPANET HOST AT RCCS SHOULD SEND 
TRAFFIC TQ THE MILNET VIA THE ARPANET INTERFACE OF THE MILBBN GATEWAY. 


TWO THINGS ARE WORTHY CF SPECIAL ATTENTION. FIRST, IN THESE TABLES, 
ALL HOSTS AT A GIVEN IMP ARE HOMED TO THE SAME GATEWAY. FUTURE TABLES 
MAY NOT HAVE THIS PROPERTY. LOAD-SHARING AMONG GATEWAYS IS CURRENTLY 
IMPLEMENTED 3U THAT ALL MILNET HOSTS AT A GIVEN IMP ARE HOMER TO THE 
SAME GATEWAY AND SLL ARPANET HOSTS AT A GIVEN IMP ARE HOMED TG THE 
3AME GATEWAY. HOWEVER, IT IS NOT NECESSARILY THE CASE THAT AN ARPANET 
40ST AND A MILNET HOST AT A GIVEN IMP WILL USE THE SAME GATEWAY. 
3ECOND, IN THE TABLES WHICH FOLLOW, NG INFORMATIGN IS GIVEN ABOUT 
BACKUP GATEWAYS, THE SECONDARY GATEWAY MECHANISM WILL BE IN PLACE FOR 
THE ACTUAL SPLIT OF THE NETWORK ON OCTOBER 4. BUT NOT FOR THE FIRST 
TEST ON SEPTEMBER 3. THUS, NEW TABLES WILL BE DISTRIBUTED PRIOR TO 
ICTOBER 4. 


MAIL BRIDGE ADDRESSES 


tL OG N 6 ARPANET MILNET 
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Host, table generated by 


ROC-NET Network: 


WAITS 9.16/R 
ddW on 


Prevar AL (CP) 


09/25/83 
Lae 


Host number Official Name Machine System 
BERNE DEC-2040T TOPSS6 
BENE DEC-10 
BBNG DEC-2O06RT 
AL. TACOMA UNENOWN 
BBN-FPTIF~GATEWAY PLURI BUS UNENGUWN 
BENA DEC~20807T 
BENG DEC-10 
“’ means thee site is a server 
SAOTNET Nevtworte: 
H Official Name Machine System 
SATNET UNE-NOWN UNENOWN 
ETAM—EXPA! H-BL6 SIMF 
BOONHILLY-EXEAR # 1G SiMe 
1 H & SIMF 
POP-1L1/45 MOS 
CLARESBURG-1G C/aO SiMe 
SATNET-S INE UNENGWA, UNENOWN 
NTARE~GATEWAY FDF-11/40 Mos 
4.0.0, 40 SATNET-ECHO - UMENUWAL 
4,0.0.41 ETAM-MGNITOR SIMP 
+949, GOONHILLY MONT TOR H-3BiG SIMF 
Aaa Oe A® TANUM-MONT TOR SIMF 
A.9.0.60 UCL.-GATEWAY MoS 
ow oe CSS~GATEWAY Mos 
/ D. ETAM-ECHO Sime 
4.0.0, ia GOONHILLY-ECHO SiMe 
4.0.0, 64 TANUM-ECHO Sime 
WOO. FR RAS ING UNENOWN UNENOWN 
AG. 76 LSE-Li/25 MOS 
3 SIMF 
TING Sata H-S16 SIMF 
RAISTING-EXPAK SIMF 
FUCING UNE-NOWN 
FUCINO~1 SIMF 
FUCING- Sime 
FUCTNO-MON 1 SIMF 
4.00.99 FULD ING-EXF: SIMF 
* means t1 site ig a server 
Network: no hosts 
work s 
numb te Official Name Machine Syste 
#8.0.0.2 BENCCA O79 UNIX 
*6,.0,0.35 BENCCG C/70 UNIX 


S9~ AU BS 6 


O.4 BENCCF 

eS BBEN-CDNOL 
47 RENCCS 

o.8 BENDOX 
2O,10 BBNCC4-TAC 
CSNET-CIC 
BENCCE 
BEN-UNIX 
BBN-CD 
BEN-ADMIN 
BENZ 
BEN-VAX 
BBN-NOC 
BENCCC 
BBNCCE-TAC 


LnTAC 
BEN-INOC 
BENCCE 
BENCCY 
BENE! 


ac 


DIVE-TAC 
BENCCD 
BENCCI 
BBNCCW 


BBNH 
BENCCY 
TAC-NEWS 


* means this site is a4 .server 


* Networ tr: 
Official Name 


F.0,.9.11 BRAGG-GWY1 
* means this site is a server 


GEPOANET Networks 
Official Name 


UCLA-CS 
SRI-NSCLL 
UTAK-CS 
UTAH-GATEWAY 
EBNF 

MIT-MUL TICS 
HARV~1O 


ROCHESTER 
TST ~-SPEECHIL 


#10,0,0 SEISMO 
#100 USC-ISID 
CCA-UNIX 
#10.0.0 FARC-MAXG 
#10.0.0 PURDUE 


Se Tee 


VAK-LL/S 750 
C/78 
C/70 
as79 
C470 
C/ 70 
VAX~11/780 
g/70 
O77 
o/ 30 


o470 
C/70 
C70 
C7 


SWAY LSI-L1i/2 
BEN-F ITBER-GATEWAY 


Machine 


LGIn-ii/2 


Machine 


VAX-LL/750 


DEC-1080 
VAX-11/750 


VAX-11/780 
DEC~2060T 
VAX~11/780 
MAXE 
VAX-11/780 


UNITX 
UNEX 
UNTX 
UNIX 
TAC 
UNEX 
UNTX 
UNTX 
UNIX 
UNTX 
UN EX 
UNTX 
UN EX 
UNIX 
TAS 
UNIX 
TAS 
UNIX 
UNIX 
UNIX 
Tac 
TAC 
UNIX 
UNIX 
UNIX 
UNIX 
MOS 


LSEL-11/23 


UNIX 
LINTX 
UMIX 


Syvetem 


MOS 


System 


LOcus 
UNIX 
UNIX 
UNIX 
TOPS20 


TORSLO 
UINTX 
WATTS 
UNIX 
EFOS 
UNIX 
TOFS2O 
UNIX 
TENEX 
UNTX 


MOS 


MULTICOS 


LUV IBS 6 


#19404 
FAO.O, 


Lo, do, 1 
whOwd, o 


qo... 
eI, 
*LOWd, 


BRAGG-GWY 1 
MIT--XX 

COL.LINGS-FF 
ST i 


SUMEX-—ATM 
UTEXAS—1i 
BEN-TEGTO-GW 
BBN-NOC 
MIT-Gw 

UCE-Al 
DEC-TO! iP) 
HI-MULTICS 
COLUMETA-20 
WASHINGTON 
WISC~GATEWAY 


Tsit-l MCON 
ISI-SPEECHL1L 
ISI-WECiL 


MIT-DMS: 
RAND-F 
LL-VLSTI 


STANFORD-GATEWAY 


CMU-CS-A 
MITRE-GATEWAY 
RADC-PSAT-IS 
DCEC-—GATEWAY 


SU-DSN 
UTEXAS-20 
BBN-TAC 
BBN-WNIX 


CISL~-SERVICE-MULTIC 


DEC~MARLEGRO 
SACL-TAC 
BEN-VAX 


SRI-~STAG 
SRI-PSAT~1G 
SRIIOYVEI 


TSI—Me 


ISI-MAINTIL 
ISI-VAxXA 


VAK~11/780 
UNENOWN 
C/I 
PDP-LL 
VAX~11/780 


PDF-1L1/34 
VAX—11/750 


DEC-2060T 
DEC-1040 
VAK—1L1/750 
VAK—1Li/780 


MOS 
TOFS20 
ELF 
yORS20 
TOF: 
TOF B20 
TORSO © 
UNIX 
UNENOWN 
UNIX 

Mos 

UNITX 
TOFS2ZOAN 
MULTICS 
TOFS20 
TOP S20 
Mos 

UNIX 
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OS/M¥S 
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ITs 

UNTX 
UNIX 
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H~6B/80 


TOFSLO 
UNIX 
UNENOWN 
Mos 
TOFSZO 
EFOS 
VMS 
ELF 
ELF 
Mos 
Mos 
UNIX 
UNIX 
UNIX 
TOFS20 
Tac 
UNIX 
MULTICS 
TOPS20 
Tac 
UNIX 
UNIX 
UNIX 
UNKNOWN 
UNENOWN 
UNIX 
EPOS 
EFOS 
EFOS 
EFOS 
UNIX 
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“A THENE 


Isi~ MYCROFT XXX 
ISi-CMR 
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isie ~PNGII 


UTAH-TAC 
BEN 
MI 
RAND-TAC 
YALE 

Lb XM 
SU-TAC 
CMU-GATEWAY 


BRAGG-TAC 
BEN-FSAT-IG 
MIT-TSTGW 7° 


ATDS-UNIX 
RUTGERS 
UT-SALLY 
MIT~TAC 
UCB-VAX 


SAC-MILNET-GW 
EBN-INOC 
WASHINGTON-TAc 


UCLA ATS 
SRI-TSC 
UTAH-2O 


RAND UNE x 


EDN- LIN 
ISI-~FPSAT~1G 
WHART: 


HE? 

IMSAT 
FDP}J1/40 
UNENOWN, 
VAX-Li/750 
FOONLY-F4 
HLS 


UNE] BONN 


PDF-11/40 
VAX~ poe 


FPDP-21770 
DEC~-1O90T 
VAX-21/750 
DEC-2060T 
VAK~-11/780 
Cs 
VAX-11/750 
LSi-i/2s 


VAX-11/780 
VAX-L1/750 
DE! ) 
DEC~-2060 
VAX-11/ 750 
FDI Li saa 


VAX-2L 1/780 
UNENOWN 


CADLING 


FPLURIBUS 


EFOS 
UNENOWAL 
Locus 
TENEX 
TAC 


UNENOWN 
UNENOWN 
TAC 
UNIX 
UNIX 
TAL 
UNENOWN 
MOS 
TAC 
MOS 
UNIX 
MOS 
TAC 
ALTO-OS 
MoS 
Tac 
UNENGWN 
MOS 
TAC 
UNIX 
TOF S23 
UNIX 
TOF'SSEO 
UNEX - 
TAC 
UNIX 
Mos 
UNIX 
TAC 
UNIX 
UNIX 
TOFS20 


UNIX 
UNE-NOWN 
TOF 
TOP S20 
FUZZ 
FUZZ 
UNIX 
UNE-NOWN 
VDA 


|e Y¥WB-/ 


NET~5-GOTEWAY 
BEN-VAN-GW 
MET=MC 


SRI-R2DE 


SAC-GATE! 
UW-VLSI 

UW-VLST—GW 

CORNELL, 


#10,4.0,17 


#10,4,0,49 EBN-CLXX 
. SRI-MILNET-GW 

SRI-TU 
BEN-MILNET—GW 
LL~GW 
DCEC-I T 
DCEC-PSAT-IG 
CLARKSBURG~IG 
SRI-VAX 
LL-SST 


BEN-NOCE 
DCEC~MILNET=6W 


# means this site is a server 
iT Network: no hosts 


FDN Nekwor ks 
Host number 


Official Name 


PURDUE~TN 


72.6 


UK-SATNET 

#14007 WISC-IBM 

e RAND-TN 
UCL 


14,0.0.10 BEN-VAN-GW 
* means thig site is a server 


MIT Networ 
Host numb 


Official Name 


PDF-i1/ MOS 
PDF-1L1 34 EFOS 
FOONLY-F° TENEX 
LGI-1i/2 MOS 
UMENOWN UNENOWN 
DEC-1o80 ITS 
LSI-11/2 MOS 
DEC-LOFOT TORPS20 
LSI-11/2 MOS 
PDF-Li/23 Mos 
VAX-11/780 UNEX 
VAX~L1/780 UNIX 
VAX-11/780 UNTX 
VAK-11/780 UNEX 
UNENOWN, UNKNOWN 
FPDF-11/44 UNIX 
DEC-—2060 TOFS2O 
PDF-11/44 UNIX 
PDP-11/70 UNIX 
C/70 UNIX 
LST-Li/235 MOS 
VAK~-11/780 VMS 
LSI-1i/23 MOS 
POP 11/44 EPOS 
FLURI BUS UNE NOWN 
UNENOWM UNKNOWN 
t/a SIMF 
UNENOWN VMS 
VAXK-11/780 UNTX 
C/70 UNIX 
LSY-il/23 wos 
Machine System 
VAX-11/780 UNIX 
VAK@L1L/780 UNTX 
VAX-L1/750 UNIX 
VAX-11/750 UNTX 
UNENOWN UNENOWN 
UNENGWA LOGICAL—HOST 
UNENOWN UNENOWS 
TRM-4341 VE /EMS 
VAX-1L1/750 UNIX 
UNENOWKL LOGICAL-HOST 
UNENOWIN UNENDWN 
Machine System 
PDP-it MOS 
PDF HLL MoS 
UNENOWN UNENOWN 
UNENIGWN UNENOWN 


/ Gov WEE 


#18, 10.0, be 
*1S8.10.0.67 
#18.10.0.68 
0.9.69 
0.0.70 
1B.10.0.71 
¥18,10,0,.72 
#18.10.0, 
*18.10, 
q 10.0, 75 
*18,10.0.76 
#18. 10. O.77 


#18. 10,0,87 
#182100, 89 


MIT-MURTEL 
MIT~ALTO- 


MIT=AL.TO- 
MIT~SPOOLE! 
MIT-NE~ALTG 
MIY-ALTO-S02 
MIET-ALTO-828 
W1IT-ALTO 
MIT-BH- 
MIT-ERIDGE 
MIT-RTS 
MIT-RTS40 
MIT-VAX 
MITXX-44 
MIT-TIU 
MIT=TIU 
MIT-GW 
MIT-BRIDGE 
MIT-CSR 
MIT-RTS40-V2 
MIT=ATAX 
MIT-BORAX 
MIT-COMET 
MIT=DUTCH 
MIT-MRCLEAN 
MIT-BOLD 
MIT-FAB Lj 


MIT-DASH 
MIT-TIDE 
MIT-FLA 
MIT-CLS 
MiT~GRAPE-NEHT 
MIT-HE INEREN 
MIT-OA 
MIT-MACEWAN 
MIT~EKIRIN 

MIT WOLSON 


MIT-RINSO 


* means this site is a server 


MITRE Network 


MINET Network 


Host number 


no hosts 


Official Name 


MINET-OBL-EM 
MINET-NAP-EM 
MINET-OBL~TAC 
MINET-STT~TAC 
MINET-RAM~TAC 
MINET-HDL.~TAC 


POR 2 1 
UNKNOWN 
UNE NOWN 
UNENOWN, 
UNEWOWN 
UNENOWN 
UNENOWN 
ALTO 
UNENOWN, 
UNENOWN 
UNENOWN 
UNE NOWN 
POP-i4 
FDP-14 
PDP-il 
UNENOWN 
VAX—11/750 


PDP 11/45 
UNENOWN 
VAX-1L1/750 
VAX-1L1/750 
VAK-11/750 
VAXLI/S7S0 
VAKWLLA TSO 
VAX=1L4/730 
VAX-11/750 
VAX-L1/750 
VAX-11/750 
VAK~21/750 
VAX-LL/ 730 
VAK-L1/750 
VAX<L1/750 
VOX-11/780 
VAX-11/750 
VAX Li / 750 


Machine 


MOS 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNE NOWN 
TFTPSF 
UNENOWN 
UNENOWN 
UNIENOWN 
UNKNOWN 
MOS 
MOS 
UNIX 
UNENOWN 
UNIX 
UNENOWN 
MOS 
MOS 
Mos 
MOS 
UNIX 
UNE-NOWN 
UNIX 
UNIX 
UNIX 
UNIX 
UNTX 
UNTX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNTX 
UNIX 
UNEX 
UNIX 
UNIX 
UNIX 
UNTX 
UNIX 
UNTX 
UNTX 


System 


UNIX 
UNENOWN 
TAC 

TAC 

TAC 

TAC 


[GY 7! BS 6 


Means 


RSRE~E KF 
Host number 


% means 


PALNET 


B.O.0 


thie 


MINET-BRM-TAC 


thas site is a server 


febworks 


Official Name 


RSRE-| —-BATEWUAY 


~BATEWAY 


5 a server 


cnn ts 
Official Name 


NOSC-CC 


MITRE 
RADC-MULTICS 
NBS~VMS 

DCEC 


ARFA-TACS 


BRL “ 

BRL-BATEWAYS 

BROGES-AFB-TAC 

NES. 

LBL-NMM 

NOSC~SECURES 

COINS-TAS 

NCC-TAC 

OFF ICE-1 

ARRADCOM-TAC 

WPAFB 

BENB 

DARCOM-TEST 
BC-AD 

TYCHO 

NYU 

NYU-Gw 

STL-HOSTI 

AFSC-SD 

AFSC-HA 


SRI -NIC 
SIMTEL2O 
NEMS 
DINSRDC~GW 
BBNCCT 


C 
C 
O/70 

LSI-LA/ES 


Machine 
UNENOWN, 


UNENOWN 
UNENOWN 


Machine 


VAKKLL/ 750 


C/7O 


HONEYWELL ~DFS-8/70M 
VMS 
MVS/SF 
UNTX 
TOFSEO 
UNIX 


VAX— L1/780 


PLURIBUS 
VAX1L1/780 
FLURIBUS 
PLURIBUS 
H-214 
FOONLY-F4 
C/20 
FDP-34/50 


1/750 


H-60/68 
H-49/68 
H-688o 

SL-B060 
O4aoT 
VAX-LI/ 750 
VAX-1L1/730 
C/70 


TAC 
TAC 107 
UNIX 
Mas 


System 


EPMGS 
UNENOWN 
Envios 


System 


UNIX 

UNIX 

TOPSIO 

TSS/260 

UNTX 

MULTICS 


RSXiiy4 
TENEX 
UNIX 
RGXLIM . 
UNIX 
UNTX 
UNIX 
TORSO 


MULTICS 
MULTICS 
MULTICS 
TOFS20 
TORPSZ0 
UNIX 
UNIX 
UNIX 


/0-Y 18-16 


| 
| 


B6.1.0.59 
26.1.0.60 


NSWC-DL 


SANDIA 
NLM-MCS 
LANL 


TEWAY 
YEST-TAC 
IS1~MILNET-GW 


SAC~MILNET-~GW 
ARPA-MILNET-GW 


CINCFACE 
BEN-MINET—~A~@Wa 
OFFICE-2 

ARDC 
WEAFB-AFWAL. 
AFWL. 

NCSC 

ANL-MCS 
COINS-GATEWAY 
BNIL 

SCOTT=TAC ss 
CORADCOM-TAc 
ALMS@=i0° 
MARTIN-B 
AFSC~SD-TAC 
AFGL 
AFSC-HO~-TAaC 
uses2-TAC 
uses3-TAc 
SRI-WARF 


USC-ISTE 
SACa~TAC 
LOGICON 
NSWO-WO 
GUNTER—TAC 
AMES-VNSA 
MUTRE-T. 
RADC 


PDF 21/40 
VAX—LL/7S0 


RSxiim 


yax- ‘1 1/750 


FOONLY-F 4 TENEX ~ 

UNENOWN 

UNE-NOWN 

MOS 

MOS 

MOS 
ST MOS 
VAKK1LI/ 780 UNIX 
DEC-2040 TORS2O 
MLC TAC 
VAXLE/S 7A VMS 
DI 1099 TOPS16 
C/30 TAC 
Cf7O UNIX 
VAK-LL/ 780 UNIX 
VAK-1L1/780 VMS/EUNICE 
RSM PLI 
LSt-11/23 MOS 
FOONLY-F4 TENEX 
VAX-1L1/780 UNIX 
FLURIBUS VDA 
PDP-1i/50 - RSXLIM 
VAXK-11/780 UNIX 
VAX £1 / 780 UNIX 

PL 

UNIX 

TAC 

TAC 
VAXK-1LE/S 750 UNIX 
VAX-1L1/750 VMS 

rac 

RSX1LiM 


PLURIBUS 
C/70 
VAX 11/750 


PDP-11/45 


in) 


vax~ lis? 


9 Vi/8-Ve 


co) 
& 
& 
& 
6,2 
& 
& 
oy 
& 
ro) 
& 
ro) 
& 
& 
4 
& 
4 
& 
& 


REDSTONE—TAC 
OFF ICI 
WPAFE~TAC 


AFSC-DEY 
Acc 


COMP TON-VMS 
MARYLAND 
CORADCOMS~TAC 


AEROSPACE 
AFGL-TaC 
USGS 1—AMDAHL 
USSS3—VMS 
SRI-MILWET-GW 
WSMR-TAC 
YUMA-TAC 
DAVID-TAC 
NSwo-Tac 
NWCO-TAC 
NUSC-NFT 
OFFICE-15 
$1-B 
FPAXRV-NES 
ADA-VAX 
EOREA~TAC 
NFRDC 
NRL-TOF'S 10 
AMES-VMSB 
RADC-TORS20 
NES-RL * 
USC-ECL 
BRL~GATEWAY 
FNOC-SECURE 
NOSC~SECURES 
OFF ICE-7 
OKC—UNTIX 
WEAF EINE OL 
BENC 
AFSC-AD-TAC 
JPL=-VAX 
ROBINS-UNIX 
MARTIN-ED 
MITRE~BEDFORD 
USGS1-TAc 
WSMR7OB 

Yura 
MCCLELLAN 
DTRC 
NSRDCOA-BW 


NSWO-O45 
NWO-SE7E 
NUSC 

S1-c 
PAX-RV~TAG 


11/25 


11/44 
11/76 
VAK—LL/ 750 
VAK-11/780 


Gs 
VAX@1LL/ 780 


C/30 
AMDAHL. V7 
VAXKLL/S7BO 
LSI-1Li/23 


FOONLY-F4 
VAX<LL/S7S0 
VAX-11/730 
VAX-11/780 
UNENOWN, 
VAX-Li7 7380 


DEC-2040T 
FDP-11/70 
DEC- OE 


1/70 
11/780 


11/70 
VAX-1L1/780 
VAxX@11L/ 750 
C/70 
Let 
VAK~LI/ 780 
VAX—-1LL/780 
FD: 


VAX-LI/S7EO 
Csa0 


TAC 
TENEX 
TAC 
TAC 
Mos 
TAc 
RSX11M 
WNTX 
VMS 
UNIX 
TAC 
Tac 
TAC 
UNIX 
TAG 
TEM /VMS 
VMS 
MOS 
TAC 
TAC 
TAC 
TAC 
TAC 
UNIX 
TENEX 
UNIX 
VMS 
VMS 
UNENOWN 
UNTX 
TOFS1O 
VMS 
TOFS20 
UNTX 
TOFS20 
Mos 
PLT 
PLI 
TENEX 
UNIX 
Ves 
TENEX 
TAC 
VMS 
UNTX 
RSXL1IM 
UNIX 
TAC 
UNEX 
UNE NOWN 
UNIX 
SINT X 
UNTX 
UNEX 
UNENOWN 
UNIX 
VMS 
ELF 
UNTX 
TAC 


/Go- YUB-He 


"#138.8.0.9 


3. 8.0.14 
#128.8.0, 955 


* means this 


UMD? 
LMDA 
UMDE 
UMDS 
UMDD 
UMDE 
UMDF 


site is a server 


ISI-NET Networks 
Host number 


P6046 
2 940,417 


#128.9.0,4 
#128.9.0. 1% 


* means this 


Official Name 


ACCUTEST 
SI-ELVIRA 
IS1-HOBSOBLIN 
SI-MOE 
“TROLL 


TSI-CuRLy 
ISI-SHEMP 


TSi-XORN 
TSI-VLSIA 


ISI-DAWN 
ISI-RISING 
ISI-SPANEY 
IST~ALFALFA 


TSI-DARL. 
TS1~BUCKWHEAT 
IGI-STYMIE | -: 
ISI~FARINA © 


~FROGGIE 
ISI-WABZ 
ISi-RANDY 
Ist~RAGS 


site is 4 server 


FURDUE-CS Networks: 


Host number 


#i28.10.0.6 


* means this 


Official Name 


PURDUE 
FURDUE-MORDRED 
CSNET-FURDUE-6W 
FURDUE-CS-GW 
PURDUE-MERL IN 


site is a server 


BRN-CRONUS Nerkwork: 


Host number 


* means this 


Official Name 
BEN-CGTWY 
BEN-CVAX 
BBNV1?. 


site is a server 


UNENOWN 
UNENOWN 
UNKNOWN 
LSI-411/23 


UNE-NOWA 


Machine 


LSi-11/ 
Lis? 
VAKLL/ 750 
VAX-LES7EO 
VAK-11/750 
VAXK1L1L/750 
VAX-LI/ 750 
VAX LES 750 
VAK@LL/ 750 
VAK~L1L/ 780 
VAX-1L1/750 


Po 
TBM-FC 
TEM-FC 
TEM-PC 
TBM-PC 


Machine 


VAX-11/780 
VAX-1Li/780 
VAX-LL/ 780 
PDF 11/34 

VAX-L1L/7B0 


Machine 


Leth i/2 
VAX-LLS 730 
VAX-11/780 


FUZZ 

UNENQUWN, 
UNENOWN 
UNENOWN 
UNENOWN 
FUZZ 

UNENOWN 


System 


RSX-11™ 
QIN TX 
VMS 
UNIX 
UNTX 
UNTX 
UNEX 
UNTX 
UNIX 
VMS 
VMS 
MOS 
UNIX 
UNIX 
MS-DOS 
MS-DOS 
MS-DBS 
MS-DOS 
MS-DBS 
MS—pos 
MS~DO8 
MS-DOS 
MS-DOS 
MS-DOS 
MS-DOS 


System 


UNIX 
UNTX 
UNTX 
Mos 

UNTX 


System 


MOS 
VMS 
VMS 


IELTS TNE NEMS Da ED IEF EA AS EIR TIME PII TEI. PEDO RAI APTA ORBEA ITE, 


bn. Oud USC-Ist 
DCA-EMS 
NOSC-F4 
WFAFE-JALCF 
SRI-TACACS 
BBN-RSM 
RADC—UNEX 
WEAFB-AFITA 
MARTIN 

VER TAG 
NRL-ARCTAN 
SE-CRD 
NES—-AMRF 
MRL-CSS 
NBS-SST 
ETL-Ar 
TEST-MAILBR 


% means this site is a server 


NOSC-LCCN Network: no hosts 
WIDEBAND Metwork: 
Host number Official Name 


ISI-PSAT-IG 
LL-FSAT-IG 
ISi-MCON 
DECEC-PSAT-1G 
SRI-FSAT-IG 
RADC-PSAT-T6 | 
LL-GW ~ 
LL-GW 


S8.19.0,0 
* means this site is a server 


UEOL-TAC=N 
Host numb 


T Networks 
ar Official Mame 


nO 4 
OLAS 


UCL-Tac 
UCL~BATEWAY 


* means this site is a sarver 


RSRE-NULL Networks 
Host number Offi ah 


Name 


RSRE-GATEWRY 
UCL-GATEWAY 


* means this site is a server 


SU-NET-TEMF Networks 
Host number Official Name 


SU-SHASTA 
SU-HNV 
SU-AT 
SU-SCORE 


STANFORD-GATEWAY 


TOFS20 
UNIX 
FOONEX 
VAX-11L/780 VMS 
FOONLY-F4 TENEX 
PLURIBUS PLI 
PDF-i1/45 UNIX 
1/780 VMS 
1/45 RSX 
TAC 
1/40 RSX11 
VAX-L1L/780 VMS 
VAX~-11/780 Yves 
VAK~LL/ 780 UNIX 
VAXK-11/750 UNIX 
VAX-1Li/780 VAS 
LSL~1L1/25 UNENOWN 
Machine System 
UNENOWN ONENOWNM 
UNENOWN UNENOWN 
PDP-11/44 EFOS 
ONENOWN, UNENOWN 
UNENOWN UNENOWN 
PLUR I BUS UNENOWN “ 
PDF~-11/44 Eras 
FDP-11/44 EFOS 
Machine System 
Tal 
MOS 
Machine System 
UNKNOWN EMMOS 
PDF-11/40 Mas 
Machine System 
LSI-11/23 MOS 
VAX-11/780 UNIX 
VAK-11/780 UNTX 
DEC-10O80 WAITS 
DEC-—2040 TOFS20 


196-VH3- /@ 


36.45.0,.85 
36.45.0087 


SU-NAVAIO 
SU-WHETNEY 
SU~GLACIER 
SU-STAR 
SU-CARMEL 
SU-SIERRA 
SU-ARDVAX 
SU-SAFE 
SUMEX-AIM 


* means this site is a server 


SREI-LOCAL Networks 


Host number 


#39.128.1 
#29,128.3. 150 


Official Name 


SRI-TSC 
SRI-TSCA 


* means this site is a server 


BEN~TEST-A Network: 


AMPRNET Networks 


C2 FR Networks 
Host number 


AS.O.0,84 
#45,0.92.2 
45.0, 32.4 


no hosts 


na hosts 


Official Name 


SRI-ReDS 
SRI-SFAM 
SRI-ROLM 


* means this site is a server 


BERKELEY Network: © ~ 


Host number 


#45.0,0,4 
#46.0.0.5 
#46.0.0,6 
#46,9.007 
*46.0.0.9 
#46,0.0.10 
*46,0.0,41 
*#46.0,.0,12 
#46.0,.0.15 
#4G.0.0,14 
*46.0.0.15 
#46.0.0.197 
#46.0.0.28 


Official Name 


UCBARFA 
UCBCAD 
UCBERNIE 
UCBMONET 
UCBESVAX 
UCBVAX 
UCRKIM 
UCBCALDER 
UCEDALE 
UCEMATISSE 
UCBMEDEA 
UCBINGRES 
UCBCORY 


* means this site is a server 


SAC-FR-TEMP Networks 


Host number 


47,0.0.11 
#47,0.32,3 


Official Name 


SAC-GATEWAY 
SAC-VAX 


* means this site is a server 


VAK-L1L/7B80 
VAX-11/780 
VAK-11/750 
VAK~LES 780 
VAXA1L1L/ 750 
DEC-2060 

VAX-11/750 
VAX-L1/750 
DEC~2060 


Machine 


PDP-11/44 
PDE-11/44 


Machine 


LSI-11/2 
VAX-11/780 
ROLM-1666 


Machine 


VAX-11/780 
VAX-11/780 
VAX-11/780 
VAX-11/750 
VAX-11/780 
VAX-11/7B80 
VAX-11/780 
VAX—11/750 
VAXWLL/7SO 
VAX-11/750 
VAX-1L1/750 
VAX~11/780 
VAX-11/780 


Machine 


FDP-11/23 
VAX-11/780 


UNIX 
UNIX 
UNIX 
VMS 
UNIX 
TOFS26 
UNIX 
UNIX 
TOPS20 


System 


UNTX 
UNIX 


System 


MOS 
UNIX 
RMX /RDOS 


System 


UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNTX 
UNIX 
UNTX 
UNIX 
UNIX 
UNIX 
UNIX 


System 


MOS 
UNTX 


/9o- CHE SO 


Host numbe 


48.0,0.4 
e48.2.1.41 


-TIU Networks 


Official Name 


NTARE-GATEWAY 
NDRE 1 


* means this site is a server 


NTA-RING Networks 


Host number 


Official Name 


NTARE-GATEWAY 
NTA-VAX 


* means this site is a server 


BEN-TEST-B Network: no hosts 


CMU-NET Networks 
Host number 


¥128.2. 251.5 
128.2.254.36 
*128,28. 254,128 
*¥128.2.254.129 
#128.2. 254.130 
*128.2.254.131 
¥128.2,254, 132 
*128.2.254,1233 
¥128.2. 254.136 
#128.2,254.138 
#128.2.254.139 
*128.2,254.140 
*128.2. 254.143 
*128.2.254.144 
128.2. 254.149 
*128.2.254.146 
*128.2.254.150 
*128.2.254.151 
*#128.2.254.152 
*128.2.254.153 
#128.2,254.154 
#128.23.254.155 
*128.2 .254.156 
*128.2.254, 157 


Official Name. 


CMU-EE-FARADAY 
CMU-GATEWAY 
CMU-CS-1uS 
CMU-CS-VLSI 
CMU-CS-PS1 
CMU-CS~z0G 
CMuU-cS-G 
CMU-cS-cAD 
CMU-CS-K 
CMU-RI-Fas 
cMU-cs~spacr” 
CMU-E NDALF 
CMOeRIEISL 1 
cMU-CS-3 
CMU-CS~SPEECH 
CMU-CS-FS2 
CMU-CS-UNH 
CMU-RI-ARM 
CMU-RI-1SL2 
CMU-CS-CFS 
CMU-RI-18L3 
CMU-CS-F'T 
cMu-CS-H 
CMU-RI~ROVER 


* means this site is a server 


LEL-CSAM Networks 


Host number 


*#128.3.0. 


Official Name 


LEL~CSAM 


* means this site is a server 


DONET Network: 
Host number 


*128.4.G.1 
128.4.0.1 


Official Name 


DENE 
DON~GATEWAY 


Machine 


PDP-~11/40 
LSI-ii/25 


Machine 


PDP-L1/46 
VAXK-LA/70 


Machine 


VAX-L1/780 
PDP-11740 
VAX-11/780 
VAX~11/780 
VAX-11/786 
VAX-11/780 
VAX-11/780 
VAX-11/780 
VAXLL/ 750 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX~11/750 
VAX-11/780 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX-11/750 
VAX<1LL/ 750 
VAX-11/780 
VAX-11/750 


Machine 


VAXK-11/786 


Machine 


LSI-41/25 
CSI-11/23 


System 


Mas. 
FUZZ 


System 


Mos 
UNIX 


System 


UNIX 
UNKNOWN 
UNIX 
UNIX 
VMS 
UNIX 
UNTX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
VMS 
UNIX 
VMS 
UNTX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNTX 


System 


UNIX 


System 


FUZZ 
FUZZ 


) Up VHB 


* means this site 


FORDNET Nelwork: 
Hoek mumbor 


CROCE 


DONS 
DCNS 
DCN4 
DONS 
DONG 
DCN7 
DCNB 
DCN? 


is a server 


Official Name 


FORD 
DENS GATEWAY 


FORD-LAE 
FORD-VAX 


FORD-WDLS 


FORD-WDL4 

FORD-WDLS 

FORD-WOES 
* means this site is a server 
RUTBERS Networks no hosts 
DFVLR Networks 
Host numbesr Official Name 
#1238.7.0.1 DFVLAL 

: DFYLAS 
DFVLAS 
DFVLAZ 


* means this 


UMDNET Network: 
Host number 


¥#128.8.0.4 


#128. 8. o, 8 


site is a 


ee eee 


server 


Official Name 


UMD 
DON-GATEWAY 
UMDS 

UMDS 

CVE 

UMDS 

UMDS 

UMD? 
UAD-CSD 


VAXLE S720 


UNENOWN 
UNENOWN 
UNENOWN 


Machine 


LSl-1Lis&. 
LSi-ll/2e 
LSI-11/ 


LSI-Li/23 
VAK—11/780 


DEC— 
H-68 
LSI-ti/ 


2060 


VAX 11/780 
PDP-11/45 
FDF-11/70 
ONYX-CaOO1 
ONYX-Cs8o0o0L 
FDF 11/24 


Machine 
LSI-11/23 
UNENOWN, 


UNENOWN 
LSI-11/23 


Machine 


LSI-2Li/23 


UNENOWS 
UNTVAC-1100 
VAX—-12/780 


VMS 
FUZZ 
FUZZ 
FUZZ 
FUZZ 
UNENOWN 
UNENOWN 
UNKNOWN 


System 


FUZZ 
FUZZ 
FUZZ 
FUZZ 
FUZZ 
FUZZ 
VMS 
TOPS20 
MULT ICS 
FUZZ 
UNENOWN ~ 
F UZZ 
FUZZ 
UNTX 
UNIX 
UNTX 
UNIX 
UNIX 
DCN 


System 


FUZZ 
UNENOWN 
UMENOWN 
FUZZ 


System 


FUZZ 
FUZZ 
O81100 
FUZZ 
UNTX 
FUZZ 
UNENOWN 
oS1100 
UNTX 


hee 


[96-78 


PUIANET Newt: por 


HATNET Neleorks 


ARN SAT-TE LT 


SUNET Networks 


VCLNET Met work ¢ 
Host number 
2 16.0,0 


Networ ts: 


no hog 


no hosts 


no hosts 


no hosts 


Officia i Name Machine 


UCL-GATEVIAY FOP -11/40 


UCL=-LSIH LSI-11/23 
UCL-LSIL L&Y-11/23 
UCL-LSIM LSI-1L1/23 
UCL@LSIE 


LSI-11/23 


UCL-LSIG 


TNAL-GATE UNEINOWN 


UCL SAM 
UCL. 
UCL 
UCI-| 
UCL -N 
* means ii site is a server 
MATNET-ALT Network: na hosts 
SRINET Network: na hosts 
EDN Networ ls: 
Rost number Official Name Machine 


128.19.0.28 
#128.19.1.4 


* means 


BRLNET Networks 
oat numb wir 


thie site is 2 


this site is a 


DCEC~SATEWAY 
EDN-HOST 1 


PDP-11/45 
PDP-11/45 


erver 


Offi 


al Name Machine 


BRL-GATEWAY 
BRL-VAT 

BRL ~VGR, 
BRL 


PDP H-11/34 
VAX 


BRL-TAGS 


BRL-TAC4 

AMSAA VAX-1 1/786 
EBRL.~VOC VAK@LIL/ 750 
HEL~ACE VAX"LL/ TSO 


server 


System 


“os 
Mos 
wos 
Mos 
MOS 
MOS 
MOS 
MOS 
“os 
UNENOWN 


LOG] AL-HOST 
LOGICAL~HOST 
LOGICAL-HOST 
LOGICAL.—-H&StT 


System 


Mas 
UNIX 


System 


Mos 
UNTX 
UNIX 
UNIX 
TAC 
TAC 
TAC 
TAG 
UNIX 
UNIX 


- UNIX 


/de-YWE/6 


SRI-GSPO 
SRI-R2D2 
SRI-SFAM 


LSt-lis3 
LSt-1li/2 
VAKWLES 7: 


* means 


this site is a server 


SF-PR-2 Wetworks no hosts 


BOCKWELL-hit Nekwork 


n@ fess 


BE-PR Mekwork: no hosts 


“PR Networks ma hasts 


DEMO-PR~1L Network: no hosts 


=S-PR-TEMP Networks no hosts 


1 MIT-NET MeLworks no hosts 


MIT-RES Network: no hosts 
USP-ETHER Network: no hosts 
i MISLTESTNE TL Network: mo hosts 


YALE-NET Networks no hosts 


YPG-NET Networks no hos 


S 


NGWC-NEYT Network: no hosts 


REN-TEST-C Network: no hosts 


! BEN-FIBRENET Networ 


Host number Official Name Machine 
L92.1.5 BBN-FIBER-GATEWAY 
I93.1 i BBN~CETWY 
*192R.1 66 BRENF 
#198, 4 7 BENG 
#193.1.2.68 BENA 
* means this site is a server 


CISLHYPERNET Networks 


Host number Official Name 


#192.5.1.0 
*192.5.1.1 


CISL-DEVELOPMENT-MULTICS 
CISL-SERVICE-MULTICS 


* means this site is a server 


WISC Network: 


Host number Official Name Machine 


LSI-1i/2 


MOS 
MOS 


go UNIX 


System 


TOPS2O 


System 


H-68/80 
H-68/80 


System 


MOS 


MULTICS 


MULTECS 


G6-YH AVE 


WISC-GATE: 
WISC-CRYS 
* maans this site is a 
HF -DESTGN- alDS Networl:: 
HE -TCG-UNIY Networks 


CUT-CS-NET Networks 
numb ee Official Name 


CIT-VAX 
C1T-Cs-ew 
CIT~780 


* m@ans this site is a server 


WASHINGTON Network: 

Host number Official Name 
*192.5.8.18 UW-BEAVER 
UW-LUMPY 
UW-WALLY 
tht JUME, 
UW-VLE Tf 
UW-VLGI-GW 
UW-EDDIE 


* means this site ts.aserver 
AERONET Network: no hosts 
ECLNET Network: no hosts 
CSS-RING Network: oo hosts 


UTAH-NET Metworks 
Host number Official Name 


#19205, 12,24 UTAH-CS 
*192,5.12 UTAH~GATEWAY 
#192.5.1 UTAH-GR 
#192,5.12 UTAH-SF 


* means this site is a server 
CCNET Networks no hosts 


RAND-NET Network: 


Host number Official Name 


*193.5.15.5 
¥192.5.15.9 


NYU-CMCL1 
NYU-ACFS 


VAX-11/780 


Machines 


VAK-11/780 
VAX-11/780 
VAX-11/750 


Machine 


VAX-11/750 
VAX-11/730 
VAX-LL/ 750 
VAK~1L1/780 
VAX-L1/780 
VAX~-11/780 
VAX-11/720 


Machine 


VAX-117750 
VAX-Li/ 750 
VAK~1LL 7750 
VAX-11L/750 


Machine 


VAX-11 7780 
VAX-11/7B80 


UNIX 
UNIX 
MOS 

UNIX 


Systan 


UNTX 
UNIX 
UNIX 


System 


UNIX 
UNIX 
UNTX 
UNTX 
UNIX 
UNTX om 
UNIX 


System 


UNIX 
UNTX 
UNIX 
UNIX 


System 


VMS 
VMS 


JV UBS) b 


wT 
¥192.5. NYU VAX~LI/ 780 
*192.5.15, 1.29 NYU-(is VAX 11/780 


a means this site is a server 
LANLLAND Network: no hosts 
NREL-NET Network: no hosts 
TRTO-MET Metwork: no hosts 


UCTICS Neheorks ro hosts 


SISLTTYNET Networks no hosts 


ETL Networks 


numb eer Official Name Machine 
#1925. 21,1 BRL~-BMD PDR }<11/70 
BRL-VLD F RA/70 
BRL-SVG = L 1/34 
BRLL~TGR VAX~11/7780 
192.5.21.5 BRL-GATEWAY PDR -LL/E4 
#I92.5. 21.6 BRL-VGR VAX-11/780 


* means thie site is a server 


BRLNET2 Nekwork: 


Host number Official Name Machine 
#1925, 22.4 BRL-VOC : VAX-11/750 
#1925. 25.2 BRL a PDF-1L4/70 
¥192.5,22.2 BRL~SATEWAYS BDFiL 


* means this site is a server 


BRLNETS Network: ne he 


BRLNET4 Network: no haste 


BRLNETS Network: 
Host number Official Name Machine 


192.5. 25. BRL-GATEWAY FDP ALE /34 
* means this site is a server 


NSRDCOA-NET Networks 
Host numbcr Official Name Macha nme: 


#192, 
*193, 


«f NSRDCOA-GW 
ad DINSRDOS 


* means this site is a server 


DINSRDC-NET Networks 


Host number Official Name Machine 
DTNSR GW VAX LL 750 
DINSRDCL VAX-11E/ 780 


System 


UNIX 
UNIX 
UNTX 
UNIX 
MOS 

UNTX 


System 
UNIX 


UNIX 
UNIX 


System 


MOS 


System 


UNTX 
UNIX 


System 


UNIX 
UNIX 


[We YHBA 6 


FIGRG. 278 DTNSRDCS 
means this site ig a server 
NULL-NET Nekworks na hasts 
RSRE-ACC Hatwark: no hosts 
RSRE-PR Metwork: mo hosts 


SIEMENS-MET Network: 
Host mumber O¥ficial Name 


192 1 CMU-GATEWAY 


* means this site is a server 


CILSLTESTNETS 


Network: no hos 


LISLTESTNETS Networks no hosts 


CUSLTESTNET4 Network: no hosts 


RIACS Network: no hosts 


CORNELL-CS Networks 
Host number 


Official Name 


CORNELIL~PVAX 
CORNELL 
CORNELL~GW 


* means this site is\a'server 
UR-CS-NET Networks no hosts 
SRI~C3ETHER Network: no hosts 
UDEL~EECIS Network: no hosts 
PUCC-NET-A Networks no hosts 
WISLAN Netwark: no hosts 


SU-ETHERNET Network: 
Host number Official Name 


TEST~BRIDGE 
PORTOLA 
YIN 

BOISE 
SUN-MI416 
BSUN-MJ42¢ 


SUN-Md460 
SUN-Md B30 
SUN-MI 422 
TIF=MIHA 


VAX-L1/ 750 


Machine 


PDF 11/40 


Maching 


VAX-11/780 
VAX 4780 
VAX-11/780 


Machina 


UNENOWN 
UNENOWA 
UNEMOWN 
UNENGWN: 
UNKNOWN. 
UNENOWN, 
VNENOWNM 
UUNENOWN, 
WINENOWNM, 
UNENOWN 


UNIX 


System 


UNENOWN, 


System 


UNIX 
UNIX 
UNIX 


System 


UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWK 
UNENOWN 
UNENOWN 
UNENGWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNE-NOWN 


He VU 6 


SOR LS 
Saat 1 4 
SOei Ss 
SOLS 
SOL? 


SOH24 
5O#25 


a7 
SO#SO 
SOS t 
SO#s2 
SO#FS 
50834 
SO#ZS 
SORZS 
SO#s7 
SO#40 
Seat 
SO#4e 
SO#44 
50845 
SOH4ag 
SO#47 
SO#SO 
SO#S 1 
SO#SS 
S0#ss 
SO#eS4 
50#sSs 
SORSS 
SO#s7 
SO8EO 
SOe6t 
SO#62 
SO#63 
0#64 
SO#6S 
SORES 
50867 
50870 
SOe71 
S072 
SO#75 
SO#74 
SO#7S 
SO#7TS 
50877 
SO#LOG 
SO#iod 
So# Los 
SO#1LO2 
So#io04 
SO#1OS 
SO#Li06 
SO#LO7 


TEST-~BRIDGE LGtetiy 
UNEINOWNM 
TIP-EE UNENOWN 
SUN-ERL407 UNKNGWN 
SUN-Ma2 UNKNOWN 
SUN-ERL.2598 UNKNOWN 
SUN-C UNENOWN 
SUN-ERL409A UNENOWN 
SUN~ERL 4084 UNKNOWN 
SUN-ERL409C UNKNOWN 
SUN-CISE UNENOWN 
SUN-ERL259A UNKNOWN 
TIP-TEST UNKNOWN 
FUMAROLE UNKNOWN 
SUN-MJ 420 UNKNOWN 
SUN-MJ 416A UNENOWN 
SUN-MJ402 UNENOWN 
SUN-Mg 424 UNKNOWN 
TIP-ERL-CIS UNKNOWN 
SUN-TEX UNKNOWN 
SEQUOIA UNKNOWN 
SEQUOIA UNKNOWN 
TERMAN-GATEWAY UNKNOWN 
SUN-ERL409D UNKNOWN 
SUN-ERL409E UNENOWN 
SUN-Mg 450 UNKNOWN 
SUN-ERL 40°F UNKNOWN 
SUN-MJOZt UNKNOWN 
TIP-MJHE UNKNOWN 
SEQUOIA Le UNKNOWN 
TIP-TERMANA UNKNOWN 
Te Le UNKNOWN 
TIP-GINZTON UNKNOWN 
SUN-ERL 4116 UNKNOWN 
SUN-ERL4115 UNKNOWN 
HP9SSS UNKNOWN 
SUN-ERL411 UNENOWN 
SUN-ERL4448 UNENOWN 
SUN-ERL 408 UNENOWN 
SUN-ERL 445 UNKNOWN 
SUN-ERL 4565 UNKNOWN 
SUN-ERL4098 UNE-NOWN 
SUN-MJ426 UNKNOWN 
SUN-TEST UNKNOWN 
SUN-TEST UNENOWN 
SUN-TERMANS645 = UNKNOWN 
TIF-8SB UNKNOWN 
SCANNER UNENOWN 
SUN-SETI1 UNKNOWN 
STANFORD-GATEWAY 
PINE UNKNOWN 
CYPRESS UNKNOWN 
YOLO UNKNOWN 
INYO UNKNOWN 
PORTOLA UNKNOWN 
MONO UNKNOWN 
DIEGO UNKNOWN 
MOJAVE UNENOWN 
YOSEMITE UNENOWN 


3 UNE NOWN 
UNENOWN 

UNENOWN 
UNE NOW 
UNKNOWN 
UNENOWN 
UNE NOWN 
UNENOWN 
UNINOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENDUWN 
UNENOWN 
UNKNOWN 
UNENOWN 


UNENOWN 


UNKNOWN ¢ 


UNENOWN 
UNKNOWN 
UNE-NOWN 
UNENGWN 
UNENOWN 
UNENOWN 
UNENGWN 
UNKNOWN 
UNKNOWN 
UNENOWN 
UNKNOWN 
UNKNOWN 
UNENOWN 
UNKNOWN 
UNENOWN 
UNKNOWN 
UNENOWN 
UNKNOWN 
UNKNOWN 
UNENOWN 
UNENOWN 
UNE-NOWN 
UNE-NOWN 
UNKNOWN 
UNKNOWN 
UNKNOWN 
UNKNOWN 
UNKNOWN 
LSI-11/23 
UNENOWN 
UNENOWN 
UNE NOWN 
UNE-NOWN 
UNKNOWN 
UNKNOWN 
UNENOWN 
UNKNOWN 
UNENOWN 


MoS 


/ Ue VBS 6 


Teac 


eT 


MAR 
MONT 
TRINDVY 
TO! 
NAFA 
ALMANOK 
FALOMAR 
TIOGA 
ERL-BRI DOE 
ERL—-BR EDGE 
ERL-BRIDGE 


EUREKA 
YANG 


PACIFICA 

SUME X-DOLFHIN-2 
SUMEX—-DGLEHIN~4 
SUMEX-DOLPHIN-S 
SU-SHASTA 

su~ "HIN 


HELENS _ 
SU=DSN 
Ish 

PSYCH 
8U-NaAVAaIa 
SU-WHITNEY 
SU-GLACIER 
FUT 
CIT-RELAY 
GSB-WHY 


UNENOWN 
UNENOWN 
UNIMOG 
UNENOWN 
UNENOWN, 
UMEMOWN 


UMERIOWN 
LUMENS 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNE-NOWN 
UNENOWN, 
UNENGWN, 
UNENOWN 
UNENOWN 
VAX-LL/ 730 
VAX-LI/780 


UNENOWN 
UNENDWA 
UNENOWN 
POF LL 
VAX-11/780 
VAX—1L1/780 
VAX@LI/ 780 
VAX-11/780 
VAX=-11/780 
VAX-L1/750 


UNKNOWN 
SUMEX~LOME-GATEWAY UNENOWN 
SUN-TELLS UNENOWN. 


S101-GaTEWAY 


SUMEX—~1OMB-GATEWAY 


SUN-S103 
SUN-8007 

TIP-S1O1 

SUN-TELOS 
FINE 
SUMEX— 
SUMEX-2 


UNENGWN, 
UNENOWN 
UNENOWN 
UMENQUIN, 
UNE NOQWN, 
UNENOWN 
UNENOWN 
UN NOWN 


UNKNOWN 


UNE.NOWN 
UNENOWN 
UNENOWN 


UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNENOWN 
UNE-NOWN 
UNENOWN 
UNENOWN 
UNIX 
UNE X 
WAITS 
TOFS20 
UNENOWN 
UNKNOWN 
UNENOWN 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 
UNIX 


TENEX 
UINTX 
UNENOWN 


UNENOWN 
ONE NOW 


UNENOWN 
UNENOWN 


UNENOWN 


UNENOWN 


VU W3-Sé 


SU-ARDVAX VAXKLIS 780 UNTX 

SU-S AFE VAXK-11/750 UNIX 
SUMEX-—@AIM DEC—2060 TORS2O 
SUMEX-DOLFHIN-1 UNENOWN 
SUMEX—-DOLFHIN-3 a UNENOWN 
SUN-TEAL LS: UNENOWN UNENOWN 
SiO1-GATEWAY UNENOWN UNENOWN 
WEL.CH-ROAD~-GATEWAY UNE NOWN UNKNOWN 
WEL.CH-ROAD-~GATEWAY UNENOWN UNENOWN 
LOTS-4 

LOTS-B 

SUN-CERAS 125 

TERMAN-GATEWAY UNEINOWN 
TIP-+-CERAS UNENOWN 
TIP-CERASI259 of UNENOWN 
TIF-TERMANE UNENOWN UNKNOWN 
TIF-TERMANC UNENOWA UNE-NOWN 
TERMAN-GATEWAY a UNENOWN 
TERMAN-GATEWAY UNKNOWN UNENOWN 
GREEN-GATEWAY UNENOWN UNENOWN 
TIP-MEVER: UNENOWN UNENOWN 


* means this site is a server 


[96-4 7/3-/6 


